Skip to content

Open Port Checker

Test whether a TCP port is open on any public IP or host: check your port forwarding, or scan the common ports at once.

TCP port between 1 and 65535, for example 443 for HTTPS or 22 for SSH.

Common TCP ports and what they are for

The scan above tests the first 21 at once. The last two are typical port forwarding cases: enter them by hand.

PortServiceWhat it is for
21FTPFile transfer (FTP). Sends passwords in clear text: SFTP over port 22 replaces it.
22SSHRemote shell and file transfer (SSH, SFTP) on Linux servers and network gear.
25SMTPMail between servers (SMTP). Often blocked on home connections to stop spam.
53DNSDNS over TCP: large answers and zone transfers. Ordinary lookups use UDP.
80HTTPWebsites without encryption (HTTP), usually just a redirect to HTTPS.
110POP3Downloading mail (POP3), unencrypted. Port 995 is the TLS version.
143IMAPReading mail on the server (IMAP), unencrypted. Port 993 is the TLS version.
443HTTPSWebsites and APIs over TLS (HTTPS). The port most likely to be open anywhere.
465SMTPSSending mail from a mail client over TLS from the first byte (SMTPS).
587SMTP-TLSSending mail from a mail client, upgraded to TLS with STARTTLS (submission).
993IMAPSIMAP over TLS: what phones and mail apps use to read a mailbox.
995POP3SPOP3 over TLS: downloading mail with encryption.
3306MySQLMySQL and MariaDB databases. Should not be reachable from the whole internet.
3389RDPWindows Remote Desktop (RDP). A constant target of brute-force attempts when open.
5060SIPInternet telephony signalling (SIP), for VoIP phones and switchboards.
5432PostgreSQLPostgreSQL databases. Like MySQL, best kept behind a firewall or a VPN.
6379RedisRedis, an in-memory database. Without a password, an open Redis is taken over within hours.
6443KubernetesThe Kubernetes API server, which controls a whole cluster.
8080HTTP-AltAlternative HTTP port: proxies, admin panels, development servers.
8443HTTPS-AltAlternative HTTPS port, common for appliance and router admin pages.
27017MongoDBMongoDB databases. Thousands of open, passwordless ones have been wiped by ransom bots.
25565MinecraftMinecraft Java Edition servers: the classic port forwarding case on a home router.
32400PlexPlex Media Server, for watching your library from outside your home.

About port checks

A port check opens a TCP connection to a specific port and reports whether it completes. Where ping tells you a machine answers, this tells you a particular service is listening and reachable: the distinction that matters when a database or an API is unreachable but the host pings fine.

What a port forwarding test goes throughThe test comes from outside, like any visitor: your router has to pass it to the right device, and that device has to answer.
  1. Our test serverInternet, from Falkenstein (Germany)
    Opens a TCP connection to203.0.113.42:25565
    Before the router: CGNAT

    Your provider shares one public address between many customers: the router's WAN address is in 100.64.0.0/10 or private. The test stops at the provider, and no rule on your side can help.

    The test shows: filtered

  2. Your routerThe only device the internet sees
    Public address203.0.113.42
    Forwarding rule25565 → 192.168.1.20:25565
    No rule, or the wrong local address

    There is no rule for this port, or it points to an old address of the device (handed out again by DHCP): reserve its address in the router.

    Usually: filtered

  3. The deviceHere, a Minecraft server
    Local address192.168.1.20
    Listening onTCP 25565
    On the device: firewall or no service

    Its firewall drops the connection, or the service is stopped or only listens on 127.0.0.1.

    Firewall: filtered. No service: closed.

TCP only: UDP has no handshake, so a silent port proves nothing either way.

the common ports of scanme.nmap.org, a host the Nmap project provides for testing: SSH (22) and HTTP (80) open, SMTP (25 and 465) filtered, the others closed.

Three outcomes are worth distinguishing. An open port completed the handshake: the service is up and reachable from outside. A refused connection means something answered but nothing is listening: usually the service is stopped. A timeout means nothing answered at all, which almost always points to a firewall silently dropping the traffic rather than a stopped service.

Frequently asked questions

The port is open locally but closed from here. Why?
A firewall, a security group or the service binding to 127.0.0.1 instead of 0.0.0.0. All three look identical from inside the machine and completely different from outside.
Refused or timeout: which is worse?
Refused is usually easier: the packet reached the host and nothing was listening. A timeout means the packet vanished, so you have both the service and the whole filtering path to investigate.
Can I check a port on my home network?
Yes, through its public address: the one your router shows to the internet, which is exactly what a port forwarding test needs. Private and loopback addresses (192.168.x.x, 10.x.x.x, 127.0.0.1) are refused by design: scanning internal ranges from a public service is a security risk, not a feature.
Does an open port mean I am exposed?
It means the service is reachable. Whether that is a problem depends on what is listening and how it authenticates. A database or an admin port open to the world is worth closing today.
How do I check that my port forwarding works?
Start the service on your computer first (the game server, Plex, the camera), then enter your public IP address and the port here: a check from outside is the only one that proves the forwarding. Open means the router forwards the port and the service answers. Refused means the router forwards it but nothing listens on that machine. A timeout usually means the router does not forward it, a firewall drops it, or your provider puts you behind CGNAT, where your public address is shared and no port can be forwarded at all.
Can I test a UDP port?
No, and no online checker can do it reliably. TCP has a handshake, so an open port proves itself. UDP has none: a closed port often stays silent too, so silence proves nothing. Many game servers and VPNs (WireGuard, for instance) use UDP: for those, the test is to connect with the real client from outside your network.

Related guides

Related tools

Go further

Network glossary: ICMP, MSS, CGNAT

Run a visual traceroute to this host