How to use it
- 1Leave the host empty to test your own public IP address, or enter a server’s hostname or IP address.
- 2Type up to 10 port numbers separated by commas, or pick a preset such as Web, Mail or Games.
- 3Click Check ports. Our server tries to connect to each port and shows whether it’s open, closed or filtered.
- 4If a port you forwarded isn’t open, make sure the program is running, check the router and firewall settings, and check again.
What open, closed and filtered mean
A port is a numbered entrance to a device: websites listen on port 443, SSH on 22, a Minecraft server on 25565. This tool connects to each port from our server on the internet – exactly like a visitor from outside would – and reports what happened.
Open means a program accepted the connection. Closed means the device answered but refused it: nothing listens on that port, or a firewall rejects the connection. Filtered means no answer arrived within 3 seconds – a firewall is silently dropping the traffic, or the device is switched off.
Only TCP is checked. UDP has no handshake, so from outside an open UDP port usually looks exactly like a filtered one, and no online checker can test it reliably.
Port forwarding and firewalls
Your router shares one public IP address between all devices in your home. When a connection arrives from the internet, the router can’t tell which device it’s meant for, so it drops it – unless you set up port forwarding: a rule that sends, for example, TCP port 25565 to the computer running your game server.
If a forwarded port still isn’t open, check that the program is running and listening on the network (not only on 127.0.0.1), that the rule points to the device’s current local IP address – a DHCP reservation keeps it from changing – and that the firewall on the device itself, such as Windows Defender Firewall or ufw, allows the port.
Why an open port can still look closed from the internet
Many providers, especially mobile networks and some fibre providers, use carrier-grade NAT (CGNAT): your router gets a private address, often from the 100.64.0.0/10 range, and many customers share one public IP address. Port forwarding on your router can’t help then, because the provider’s equipment drops incoming connections before they reach you.
Compare the WAN or internet address shown in your router with the public IP this tool checks. If they differ, you’re most likely behind CGNAT. Ask your provider for a public IPv4 address, use IPv6 if your connection has it, or use a tunnel or VPN service that offers port forwarding. Some providers also block popular ports such as 25 or 80 on home connections.
Questions and answers
How do I check if a port is open?
Enter the IP address or hostname – or leave it empty for your own connection – type the port number and click Check ports. Open means the port accepts connections from the internet. From another network you can also run nc -vz example.com 443, or Test-NetConnection example.com -Port 443 in PowerShell.
Why does my port show as closed even though I forwarded it?
The usual causes are: the program isn’t running or listens only on 127.0.0.1, the forwarding rule points to an old local IP address, the device’s own firewall blocks the port, or your provider uses CGNAT, so your router has no public IP address. Also make sure the rule forwards TCP, not only UDP.
What is the difference between closed and filtered?
Closed means the device replied and refused the connection, so the host is reachable but nothing listens on that port. Filtered means nothing came back at all: a firewall dropped the connection or the device is offline. Firewalls are often set to drop traffic silently so that scanners learn less.
Is it legal to check open ports?
Checking your own connection and servers you manage is fine. Scanning other people’s systems without permission can break your provider’s terms or local law, so only check hosts you’re allowed to test. This tool checks at most 10 ports per request and never sends data to them.
Why is port 25 often blocked?
Port 25 carries email between mail servers, and malware on infected computers abuses it to send spam. That’s why most home internet providers and many cloud hosts block traffic on port 25. Email apps should send mail through port 587 or 465 instead.