Check which ports are open on your connection

What a port check tells you

Every service on the internet listens on a numbered port. Web servers use 80 and 443, SSH uses 22, and games and VPNs pick their own numbers. A port check tries to open a connection to one of those ports from outside your network and tells you what happened. It is the quickest way to find out whether a service you run at home, such as a game server, a camera or a VPN, can be reached from the internet.

This tool only ever tests your own public IP address, the one our server sees when you connect. You cannot type in another address, so it cannot be used to scan other people's machines.

Open, closed and filtered

• Open: our server connected successfully, so something is listening and nothing in between blocked it.
• Closed: the connection was refused straight away. Your address answered, but no program is listening on that port, or your router sent a refusal.
• Filtered: no answer came within 3 seconds. A firewall is usually dropping the connection without replying, or the address cannot be reached from outside.

Why a port you opened still shows closed

Opening a port in a program is not enough. The connection also has to get through your router, which needs a port forwarding rule pointing at the right device, and through any firewall on that device.

The most common surprise is carrier-grade NAT (CGNAT). Some providers, especially mobile and some fibre and cable providers, let many customers share one public address. Nothing you set on your own router can then accept connections from outside. If your router's WAN address differs from the address shown here, you are probably behind CGNAT. Ask your provider for a public address, or use a VPN or tunnel that offers port forwarding.

Port 25 is a special case. Many providers block outgoing and incoming mail traffic on port 25 to limit spam, so it often reads filtered even when everything else is set up correctly.

How the check works

You pick up to 10 ports, either from the list of common ones or one custom number from 1 to 65535. Our server then makes a plain TCP connection to each port on your address with a 3-second timeout and reports the result. Nothing is sent after the connection is made, and the connection is closed straight away. The tool tests TCP only, not UDP, so it cannot test services that use UDP alone. If you connect over IPv6, the test also runs over IPv6.

To stop misuse, each visitor can run 5 checks a minute and 30 a day, and private or reserved addresses are rejected. Nothing about your check is stored.