Open port checker
Test whether a port on your public IP address accepts connections from the internet — the check you need after setting up port forwarding for a game server, a camera, remote desktop, a NAS or a torrent client. The test connects from our server to your address only, never to anyone else's.
TCP connect from our server in Frankfurt, Germany (probe-fra1) · 3 s timeout · your own address only
| Port | Service | Status | Response time | What it means |
|---|
NAT: your router hides every device behind one public address and has no rule for this port, so the packet is dropped (filtered) or refused (closed). Add a port-forwarding rule to the device's private address and the port the application listens on.
Firewall: the router's firewall, the provider, or the firewall on the device itself may block inbound connections even when forwarding is set up. Check the device firewall and whether the application is running and listening on that port. Find your router's address
Carrier-grade NAT: if every port stays filtered whatever you forward, your provider probably shares one public address between customers; no router setting can open a port then. Check for CGNAT · NAT type test
Port reference
Tap a port number to add it to the check.| Port | Service | Typical use |
|---|---|---|
| FTP | File transfer (unencrypted; avoid exposing it) | |
| SSH | Secure shell, SFTP, remote administration | |
| SMTP | Mail between servers; often blocked by residential providers | |
| DNS UDP | Name resolution (only a DNS server should expose it) | |
| HTTP | Web server, unencrypted | |
| POP3 | Mail download (unencrypted) | |
| IMAP | Mail access (unencrypted) | |
| HTTPS | Web server, TLS | |
| SMTPS | Mail submission over TLS | |
| SMTP submission | Mail submission (STARTTLS) | |
| IMAPS | Mail access over TLS | |
| OpenVPN UDP | OpenVPN server | |
| RDP | Windows Remote Desktop | |
| VNC | VNC remote screen | |
| HTTP alt | Alternate web port, proxies, dev servers | |
| Minecraft | Minecraft Java server | |
| Source games UDP | Source engine games (CS2, TF2) | |
| Plex | Plex Media Server remote access | |
| WireGuard UDP | WireGuard VPN (UDP; not testable here) |
Check a port on your IP
Enter a port number (or pick one from the presets) and press Check. Our server in Frankfurt attempts a TCP connection to your public address on that port and reports open, closed, filtered or unreachable with the response time. Up to ten ports per request, twenty requests per minute. The checker can only test the address you are connecting from; it refuses other targets so it cannot be used to scan third parties.
Open, closed and filtered explained
Open: the connection completed; something is listening and your router forwards it. Closed: your address answered with a refusal — the port is reachable but nothing listens there (the forwarding rule works, the application is not running or listens on another port). Filtered: no answer within three seconds — a firewall or NAT silently drops the packet, which is the normal state of a home connection with no forwarding rule. Unreachable: no route to your address at all.
Common ports to test
The presets cover the ports people actually forward. The common port numbers guide lists more.
Gaming ports
Game servers mostly use UDP, which a TCP connect test cannot probe; test the TCP port the game documents (for example 25565 for Minecraft Java, 27015 for Source games) and treat an open result as proof that forwarding and the firewall are right, since UDP rules are usually set up alongside. Consoles with strict NAT benefit more from UPnP or the NAT type test than from single ports.
Remote access (SSH, RDP)
22 (SSH), 3389 (RDP), 5900 (VNC). An open result on these from the internet is what you want only if you intend it — and then with key-based or strong-password authentication, updates and ideally a VPN in front. If you did not open them on purpose, close the forwarding rule.
Web and mail ports
80 and 443 for a web server, 25 (SMTP between servers), 465/587 (mail submission), 993/995 (IMAP/POP over TLS). Many residential providers block inbound 25 and sometimes 80; a filtered result on 25 from a home line usually means the ISP, not your router.
CGNAT can block port forwarding
If every port shows filtered no matter what you forward, and your router's WAN address starts with 100.64–100.127 or differs from the address shown on this site, your provider shares one public address among many customers (carrier-grade NAT). No forwarding rule on your router can help; ask the provider for a public address, use IPv6, or use a tunnel service. The CGNAT check confirms it.
Port is closed: how to fix port forwarding
Work from the outside in. 1) Confirm the public address on this site matches the WAN address in your router; if not, see CGNAT above. 2) In the router, forward the external port to the device's private address and the port the application listens on, for the right protocol (TCP, UDP or both). 3) Give the device a fixed private address (DHCP reservation) so the rule does not break next week. 4) Allow the port in the device's own firewall (Windows Defender Firewall, macOS firewall, ufw on Linux). 5) Make sure the application is running and bound to all interfaces, not only 127.0.0.1. 6) Re-run the check; closed means steps 1–3 work and step 4 or 5 is left; filtered means step 2 or 3 is still wrong.
How to check if a port is open on your computer
To see whether a program is listening locally before testing from outside, use the tools built into your system.
Windows (Test-NetConnection)
In PowerShell: Test-NetConnection -ComputerName 192.168.1.20 -Port 25565 tests a port on another device in your LAN; Get-NetTCPConnection -State Listen lists everything listening on this computer. TcpTestSucceeded: True means the port answers locally — if this page then says filtered, the router rule is the problem.
macOS and Linux (nc)
nc -zv 192.168.1.20 25565 tests a port on a LAN device; sudo lsof -iTCP -sTCP:LISTEN -n -P (macOS) or ss -ltnp (Linux) lists local listeners. The same logic applies: works locally but not from here means the router or the ISP.
Frequently asked questions
How can I check if port 443 is open?
Enter 443 above and press Check. Open means your router forwards 443 to a listening web server; filtered means nothing is forwarded (the normal result for a home connection); closed means the forwarding works but no server is listening.
How can I tell if port 8080 is open?
Same procedure with 8080. If you run a service on 8080 inside your network and the result is filtered, add a forwarding rule for TCP 8080 to that device and allow it in the device's firewall.
Is there a way to test a port?
Yes — this page tests any TCP port on your own public address from the internet, which is the only test that proves a forwarding rule works end to end. For ports on a device inside your LAN, use Test-NetConnection or nc as described above.
How to test if port 22 is open?
Enter 22. Open means SSH is reachable from the internet — fine if you set it up deliberately and use keys; otherwise close the rule. Filtered or closed means it is not reachable from outside.
How to check if port 25 is open or not?
Enter 25. Note that many residential ISPs block inbound and outbound port 25 to stop spam, so filtered from a home connection often means the provider rather than your router. Mail servers on hosting providers usually have 25 open.
Can I use port 587 instead of 25?
For sending mail from a client to your own mail server, yes: 587 (submission, with authentication and STARTTLS) is the standard and is not blocked by ISPs. Port 25 is for server-to-server delivery; if you run a mail server that must receive mail, 25 has to be open — ask your provider to unblock it or use a relay.
Results come from a live TCP connection attempt made by our own server in Frankfurt to your address; nothing is cached or stored.