Open Port Checker: check if a port is open from anywhere on the internet.

Start by confirming the service listens on every network interface, not only localhost (127.0.0.1). Next, make sure your host firewall permits inbound traffic on that port, and set up NAT port forwarding on your router if you sit behind one. Use our Port Checker to probe from an external network. A closed result indicates the host is actively turning connections away, which usually means a missing firewall rule or a service that is not running. A filtered result means a firewall is quietly discarding packets before they ever reach the host.

Type in a domain name or IP address along with a port number between 1 and 65535, then click Check Port. The tool tries to open a TCP connection from our server to your target, checking reachability from beyond your own network. Open means the port accepts external connections. Closed means the host actively refused the connection with a TCP RST packet. Filtered means no reply arrived within the timeout window, which usually signals a firewall quietly dropping packets.

A port checker dispatches a TCP SYN packet to a given host and port, then reads the response. When the port is open, the host answers with TCP SYN-ACK, completing the connection handshake. When closed, the host sends back a TCP RST packet, actively refusing the connection. When filtered, no answer comes and the request times out, a sign that a firewall is quietly dropping packets.

Port knocking conceals a service port (usually SSH on port 22) by leaving it firewalled until a client knocks on a predefined sequence of ports in the right order, for instance 7000, 8000, 9000. The firewall recognizes that sequence and briefly opens the target port for that particular IP address. Port knocking lowers exposure to automated scanners and brute-force attacks, though it is no replacement for strong authentication.

A port becomes a concern when it sits in a state you did not expect. An unexpectedly open port can point to a misconfigured service, a rogue process, or a compromised host. An unexpectedly closed or filtered port on a service you need means traffic is being blocked. The crucial difference is between closed and filtered: a closed port returns a TCP RST response, so the host is reachable but the service is not running. A filtered port returns nothing at all, so a firewall is blocking access before the host can reply.

TCP (Transmission Control Protocol) is connection-oriented and ensures reliable, ordered delivery via a three-way handshake (SYN, SYN-ACK, ACK). Typical TCP ports include 22 (SSH), 25 (SMTP), 80 (HTTP), 443 (HTTPS), and 3306 (MySQL). UDP (User Datagram Protocol) is connectionless and fires off packets without confirming they arrive, which trims latency. Typical UDP ports include 53 (DNS queries), 67 and 68 (DHCP), 123 (NTP), and game server ports like 27015 (Counter-Strike). Most port checkers, ours included, test TCP connectivity.

IANA splits network ports into three ranges. Well-known ports (0 to 1023) are reserved for standard protocols and cover HTTP (80), HTTPS (443), SSH (22), FTP (21), SMTP (25), and DNS (53). Registered ports (1024 to 49151) belong to applications that registered with IANA, such as MySQL (3306), PostgreSQL (5432), Redis (6379), and MongoDB (27017). Ephemeral or dynamic ports (49152 to 65535) are handed out temporarily by the operating system for outbound connections.

Most home ISPs block inbound connections on port 25 (SMTP), port 80 (HTTP), port 443 (HTTPS), and port 8080 to keep customers from running public-facing servers on consumer lines. Port 25 is blocked on nearly all residential IPs to limit spam at its source. A few ISPs also block port 22 (SSH) inbound. Business-grade or static IP plans usually permit these ports.

Port forwarding is a NAT (Network Address Translation) rule set on a router that steers inbound traffic arriving on a particular external port toward a private IP address and port inside the local network. When a packet reaches your router's public IP on the forwarded port, the router rewrites the destination address and passes the packet along to the internal device. Without it, all unsolicited inbound traffic is dropped at the router, since the router has no mapping telling it where to send the packet. To confirm a port forward works, run an external port checker once the rule is in place - if the port shows as open, the router is forwarding correctly to the internal service.

TCP port checking works by starting a connection handshake (SYN) and reading the reply: SYN-ACK means open, RST means closed, and no reply means filtered. UDP has no handshake at all - it sends a datagram and gets no acknowledgment when the port is open. An open UDP port just accepts the packet silently. The only signal of a closed UDP port is an ICMP port-unreachable message from the host, but many hosts suppress those messages, leaving UDP open and UDP filtered indistinguishable to a remote prober. That unreliability makes external UDP port checking impractical for most situations.

The port checker verifies that the TCP port accepts connections at the network level, yet application-layer problems can still stop your software from working. Frequent causes: the service expects TLS but your client connects without it (or the reverse); the service needs a specific hostname through SNI or virtual hosting that differs from the IP being tested; the application uses IP allowlisting that blocks your client's IP while letting the prober's through; or the service accepts the connection and then immediately closes it because authentication failed. A port shown as open means the TCP handshake finished - it is no guarantee that the service behind it will accept your particular request.

No. An external port checker fires its probes from a server on the public internet and cannot reach private IP address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or the loopback address (127.0.0.1). Those addresses are not routable on the public internet, so packets aimed at them are dropped at the first router. To check ports on a local machine or private network, run command-line tools like nc (netcat), telnet, or nmap directly from inside the same network. External port checkers are only good for testing public-facing services.

The rule of thumb is to open only the ports your service truly needs and firewall everything else. High-risk ports that automated scanners often target include: 22 (SSH) - limit to specific source IPs or move it to a non-standard port; 23 (Telnet) - turn it off completely and use SSH instead; 3389 (RDP) - never expose it publicly without a VPN in front; 3306 (MySQL), 5432 (PostgreSQL), 6379 (Redis), 27017 (MongoDB) - database ports should never be publicly accessible. Swap FTP (21) for SFTP over SSH. Periodically scan your own server to make sure no unexpected services have been exposed.

The TCP three-way handshake is the connection setup sequence that runs before any data moves. Step 1: the client sends a SYN (synchronize) packet carrying a randomly chosen sequence number. Step 2: if the port is open, the server replies with SYN-ACK, acknowledging the client's sequence number and supplying its own. Step 3: the client returns ACK to confirm receipt, finishing the handshake. Port checkers lean on this mechanism to work out port state: a SYN-ACK in step 2 proves the port is open. A RST (reset) reply in place of SYN-ACK means the port is closed. No reply within the timeout window means a firewall is filtering the port.