Check if a port is open on your own IP address or any server, test port forwarding and scan up to 30 ports at once. Every port comes back open, closed or filtered with what that means, the time, the service's banner and where it was checked from.
Checked over TCP from Cloudflare's edge nearest you, and from our own server in Mumbai for port 25 and sites on Cloudflare · IPv4 · nothing is stored
Advertisement
How do I check if a port is open?
Enter the address and the port, then select Check. The port checker opens a TCP connection to that port from the internet, the way a visitor or a game client would, and reports what came back: an accepted connection (open), a refusal (closed) or nothing at all (filtered).
Testing port forwarding? Your public IP address is already filled in: start your server, check its port, and the result says what to fix if it isn't open. For a server, type its hostname and pick a preset to scan the usual ports in one go.
The verdictThe port's state in one line, and what it means for the server or the forwarding rule.The handshakeWhat our checker sent and what came back: an accepted connection, a refusal or silence, with the time.Where it was checked fromCloudflare's edge nearest you, or our own server for port 25 and for sites on Cloudflare.Every port of a scanEach port with its service, the banner it sent and its state, and the risky ones flagged.
A port forwarding test of a Minecraft server: the state, the TCP handshake behind it and where it was checked from. Select a number to see what each part shows.
Open, closed or filtered: what does the result mean?
A TCP connection starts with a handshake: our checker sends a SYN, and what comes back decides the state. Port checkers that call a timeout "closed" hide the one difference that tells you where the problem is.
How the check went
TCP 25565 · Minecraft Java
Cloudflarenearest to you
SYN
SYN-ACK38 ms
203.0.113.7:25565 · your router
→SYNto 203.0.113.7:255650 ms
←SYN-ACKthe port accepted the connection38 ms
→ACKconnection open38 ms
←…nothing said in 1.5 s: the service waits for the client to speak first
→FINclosed by us
OpenSYN → SYN-ACK
A program is listening on the port and accepted the connection. Nothing between the internet and the server blocks it.
Port forwarding works. If players still can't join, check the game's own settings or the address they use.
How the check went
TCP 32400 · Plex
Cloudflarenearest to you
SYN
RST41 ms
203.0.113.7:32400 · your router
→SYNto 203.0.113.7:324000 ms
←RSTrefused: nothing listens, or a firewall there is set to reject41 ms
ClosedSYN → RST
The address answered and refused the connection: nothing listens on the port, or a firewall there is set to reject. Either way the address itself is reachable.
The router passed the connection on (or answered itself) but no program took it: start the server, and check the rule's local address and port.
How the check went
TCP 25565 · Minecraft Java
Cloudflarenearest to you
SYN
no reply4.0 s
203.0.113.7:25565 · your router
→SYNto 203.0.113.7:255650 ms
←…no SYN-ACK, no RST within 4.0 s4.0 s
FilteredSYN → no reply
No answer in 4 seconds. A firewall dropped the connection without a word, or nothing on the way forwards it.
The usual case of a missing forwarding rule, a blocked port in the device's firewall, CGNAT or a provider that blocks the port.
Unreachable means the network reported no route to the address. Not checked means our second server couldn't run the check this time; it is never counted as closed.
Advertisement
How do I check if my port forwarding is working?
Check from outside your network, with the server running: open on your public IP and the forwarded port means the rule, the firewall and the server all work. A check from inside your own network can fail even when everything is right, because many routers don't loop traffic back to themselves.
1
Start the server
The game server, Plex or camera must be running: a port with nothing listening is closed, even with a perfect rule.
2
Note the device's local address
Find it in the device's network settings (for example 192.168.1.20) and reserve it in the router, so it doesn't change.
3
Add the forwarding rule
In the router: external port, protocol TCP (or TCP and UDP), the device's local address and its port.
4
Allow it in the device's firewall
Windows asks the first time a server starts; otherwise add an inbound rule for the port.
5
Check your public IP from here
Select **Check** with your IP filled in. Open means it works from anywhere on the internet.
The path a connection takes, and where it can stop
1CGNAT or a blocked port at the providershows as filtered
2No rule, wrong local address, double NATshows as filtered, sometimes closed
3Firewall, server stopped or listening on 127.0.0.1shows as closed or filtered
Why is my port closed after port forwarding?
Find the line that matches what you see. The state is the clue: closed means the connection reached something that refused it, filtered means it got lost on the way.
Pick what you see
ClosedClosed, and the server is running
Likely cause
The server listens on 127.0.0.1 only, or the rule points to another local address or port.
What to do
Set the server to listen on 0.0.0.0 (all addresses) and check the rule against the device's current address.
ClosedClosed, server off
Likely cause
Nothing is listening: the router forwards the connection and the device refuses it.
What to do
Start the server, then check again.
FilteredFiltered, rule in place
Likely cause
The device's firewall drops the connection, or the rule is for UDP only.
What to do
Allow the port in the firewall (Windows: an inbound rule) and set the rule to TCP or both.
FilteredFiltered, router's WAN address starts with 100.64–100.127
Likely cause
CGNAT: your provider shares one public address among customers, so your router can't be reached.
What to do
Ask for a public IPv4 address, use IPv6, or a tunnel service.
FilteredFiltered, router's WAN address is 192.168.x.x or 10.x.x.x
Likely cause
Double NAT: a second router (often the provider's modem) sits in front of yours.
What to do
Forward the port on that device too, or put it in bridge mode.
FilteredFiltered on 25, 80 or 445 only
Likely cause
Your provider blocks the port for home connections.
What to do
Forward a different external port (8080, 2525) to the same server.
OpenOpen here, but it fails from inside your network
Likely cause
Your router doesn't support NAT loopback (hairpinning), so a device inside can't reach your public address.
What to do
Inside your network, connect to the device's local address; the internet sees the port open.
Am I behind CGNAT or double NAT?
Compare two addresses: the WAN address on your router's status page and the public address a website sees (your IP above). If they are the same, your router faces the internet directly and port forwarding can work.
If the router's address is in 100.64.0.0/10, your provider uses carrier-grade NAT (CGNAT): many customers share one public address and no port on it belongs to you. If it's a private address, another router sits in front of yours (double NAT). The check under a port's result compares the two for you.
Router's WAN address
What it means
What to do
Same as your public IP
A public address: the internet reaches your router.
Port forwarding can work: check the rule, firewall and server.
100.64.0.0 – 100.127.255.255
CGNAT: shared address space for providers (RFC 6598).
Ask for a public IPv4 address, use IPv6 or a tunnel.
10.x, 172.16–31.x, 192.168.x
Double NAT: a private address (RFC 1918) behind another router.
Forward on the first router too, or set it to bridge mode.
Another public address
Traffic leaves through other equipment or a VPN.
Find what's in front of the router; turn off the VPN.
Where a connection from the internet stops
InternetYour providerYour routerYour device
Public address
Internet
—no NAT
✓WAN 203.0.113.7
192.168.1.20
Reaches your router: its forwarding rule decides.
CGNAT
Internet
✕203.0.113.7shared by many customers
WAN 100.64.12.5
192.168.1.20
Stops at your provider: the shared address isn't yours to forward.
Double NAT
Internet
✕203.0.113.7the provider's router
WAN 192.168.0.2
192.168.1.20
Stops at the first router unless it forwards the port too.
Which ports do internet providers block?
Many home internet providers block a few ports, mostly to stop spam and worms, and some give you no incoming IPv4 at all. The list below is from each provider's own documentation (or its regulator's); others block ports without publishing it, so a port that's filtered only on your connection is worth asking about.
25 and 445 outgoing. Its IPv4 is CGNAT with no incoming connections, and its own routers can't forward ports; a public IPv4 comes only with Priority plans.
Outgoing. DigitalOcean blocks all three; Hetzner blocks 25 and 465 and unblocks them on request after the first paid month.
Port 25 is the port providers and clouds block most often, for outgoing mail: send mail through port 587 (or 465) with your mail provider instead.
Common ports and what runs on them
Port numbers from 0 to 1023 are the well-known system ports, 1024 to 49151 are registered to services, and 49152 to 65535 are left for temporary connections. These are the ones people check most.
Port
Service
Transport
What it is
If open to everyone
21
FTP
TCP
File transfers, passwords in clear text
Restrict
22
SSH
TCP
Secure shell logins and SFTP file transfers
Restrict
23
Telnet
TCP
Old remote login, passwords in clear text
High risk
25
SMTP
TCP
Mail between servers
Normal
53
DNS
TCP and UDP
DNS queries
Normal
80
HTTP
TCP
Websites over plain HTTP
Normal
110
POP3
TCP
Collecting mail (POP3)
Normal
143
IMAP
TCP
Mail folders (IMAP)
Normal
443
HTTPS
TCP and UDP
Websites over HTTPS
Normal
445
SMB
TCP
Windows file sharing (SMB)
High risk
587
SMTP submission
TCP
Sending mail from an app (submission)
Normal
993
IMAPS
TCP
IMAP over TLS
Normal
3306
MySQL
TCP
MySQL and MariaDB databases
High risk
3389
RDP
TCP and UDP
Windows Remote Desktop
High risk
5432
PostgreSQL
TCP
PostgreSQL databases
High risk
5900
VNC
TCP
VNC remote screen
High risk
6379
Redis
TCP
Redis databases
High risk
8080
HTTP alt
TCP
Web servers and proxies on an alternative port
Normal
8443
HTTPS alt
TCP
HTTPS on an alternative port
Normal
25565
Minecraft Java
TCP
Minecraft Java Edition servers
Normal
19132
Minecraft Bedrock
TCP and UDP
Minecraft Bedrock Edition servers
Normal
32400
Plex
TCP
Plex Media Server
Normal
27017
MongoDB
TCP
MongoDB databases
High risk
51820
WireGuard
UDP
WireGuard VPN
Normal
Advertisement
Which open ports are a security risk?
An open port is only a risk when the service behind it shouldn't face everyone. Web and mail ports are meant to be open; logins, databases and file sharing are not. These are the tiers this checker flags.
High risk if open to everyone
High risk
23Telnet
135Windows RPC
137NetBIOS name
138NetBIOS datagram
139NetBIOS session
445SMB
1433MS SQL
1521Oracle DB
2323Telnet (alt)
2375Docker API
2379etcd
3306MySQL
3389RDP
5432PostgreSQL
5900VNC
5984CouchDB
6379Redis
9200Elasticsearch
10250Kubelet API
11211Memcached
27017MongoDB
Attacked around the clock and a common way into networks: Remote Desktop, SMB file sharing, Telnet, VNC, databases and the Docker API. Close them to the internet or allow only your own addresses.
Restrict when you can
Restrict
21FTP
22SSH
69TFTP
161SNMP
554RTSP
1080SOCKS proxy
1883MQTT
1900SSDP / UPnP
2082cPanel
2083cPanel SSL
2086WHM
2087WHM SSL
2376Docker API (TLS)
3000Dev server / Grafana
3128Squid proxy
5000AirPlay / Flask
5985WinRM
5986WinRM (HTTPS)
6443Kubernetes API
8000HTTP alt / Hikvision
9000Reolink / HTTP alt
10000Webmin
25575Minecraft RCON
28016Rust RCON
37777Dahua
Fine when you mean to run them, but better limited to your addresses or a VPN: SSH, FTP, admin panels, proxies, MQTT and development servers.
Meant to be open
Normal
25SMTP
53DNS
80HTTP
110POP3
143IMAP
443HTTPS
587SMTP submission
993IMAPS
8080HTTP alt
8443HTTPS alt
25565Minecraft Java
19132Minecraft Bedrock
32400Plex
Web (80, 443), mail servers (25, 587, 993) and game servers on their own ports: open is normal when you run the service.
Can you check a UDP port online?
Not reliably. UDP has no handshake: a closed UDP port may answer with an error or say nothing, and an open one says nothing until it gets a message in its own protocol. A checker can only report "open or filtered" for silence, which is why this tool checks TCP and says so.
Services that use UDP only, such as WireGuard (usually 51820), TeamSpeak voice (9987) and most game traffic, can be running while every TCP checker shows them closed. Test them with the game or app itself from outside your network, or check that the forwarding rule includes UDP.
UDP only, tagged in a scan:
69TFTP
123NTP
137NetBIOS name
138NetBIOS datagram
161SNMP
500IPsec IKE
514Syslog
1194OpenVPN
1434SQL Browser
1900SSDP / UPnP
4500IPsec NAT-T
5353mDNS / Bonjour
8211Palworld
9987TeamSpeak voice
28015Rust
37778Dahua (UDP)
51820WireGuard
What comes back: TCP and UDP
TCPUDPOpenSYN →← SYN-ACKdatagram →… no replyClosedSYN →← RSTdatagram →← ICMP error or nothingFilteredSYN →… no replydatagram →… no reply
On UDP, open and filtered both stay silent: a checker can only say "open or filtered".
How to check open ports on your own computer
An online checker sees what the internet sees. To see what's listening on the computer itself, or to test a port from inside your network, use the commands that come with your system.
To find
Windows (PowerShell)
macOS
Linux
What's listening
Get-NetTCPConnection -State Listen
lsof -nP -iTCP -sTCP:LISTEN
ss -ltnp
Which program uses a port
netstat -ano | findstr :25565
lsof -nP -i :25565
ss -ltnp 'sport = :25565'
Test a port on another host
Test-NetConnection example.com -Port 443
nc -vz example.com 443
nc -vz example.com 443
On Linux, ss needs sudo to show other users' programs; on Windows, netstat -ano gives the process ID, and Task Manager's Details tab names it.
Port checker API
Free, with CORS for browsers: GET one port, or POST up to 30 and read each result as a line of NDJSON the moment it lands. The answers keep the fields of our older API and add where each port was checked from and why it got its state.
A port checker, or port tester, tries to open a connection to a port on an address from the internet and tells you what happened: the connection was accepted (open), refused (closed) or got no answer (filtered). It's the quickest way to test port forwarding for a game or media server, or to see which services on your server anyone can reach.
Is my port open if the checker says filtered?
No: filtered means nothing answered within 4 seconds, so the internet can't reach a program on that port. Unlike closed, where the address actively refused, filtered means a firewall dropped the connection or nothing on the way forwards it. For port forwarding that usually points to the rule, the device's firewall, CGNAT or a port your provider blocks.
Why is my port forwarding not working?
Most often the server isn't running or listens only on 127.0.0.1, the rule points to an old local address, or the device's firewall drops the connection. If the router's WAN address starts with 100.64 to 100.127 you're behind CGNAT, and if it's private, behind double NAT. Check your public IP here: the state tells you which of these it is.
Is this an online port scanner like Nmap?
It's a lighter, safer online port scanner: it checks up to 30 TCP ports per run with a normal connection, the way any client connects, and reads the service's banner. Nmap can scan thousands of ports, UDP and operating systems, but needs installing and permission to scan. Use this one for your own IP and servers.
Which ports are open on my network?
Only the ones your router forwards, or opens through UPnP, can be reached from the internet. Check your public IP here with the Common preset to see them from outside. To see what's listening on a computer itself, run Get-NetTCPConnection -State Listen in PowerShell, lsof on a Mac or ss -ltnp on Linux.
Is it safe to have open ports?
An open port is safe when the service behind it is meant to be public and kept up to date, like a website on 443 or a game server. It's risky when it exposes a login or a database: Remote Desktop (3389), SMB (445), Telnet, VNC, MySQL, Redis or the Docker API. This checker flags those when it finds them open.
Why is port 25 checked from a different server?
Cloudflare Workers, where this checker runs, can't open connections to port 25. Port 25 is checked from our own server in Mumbai instead, and the result says so. Many home providers and clouds block outgoing port 25 too, which is why mail apps send through 587.
Why does a site on Cloudflare show ports 8080 and 8443 open?
Because the address is Cloudflare's, not the website's server: Cloudflare's edge accepts connections on 13 web ports (80, 443, 8080, 8443, 2052, 2053 and others) for every site it proxies, and drops the rest. A port check of such a site tests Cloudflare. The server behind it is only reachable through Cloudflare, or Spectrum for other ports.
Can you check IPv6 ports?
Not yet: neither Cloudflare Workers nor our second server can reach IPv6 addresses today, so IPv6 input is refused rather than reported closed. With IPv6 there's no NAT, so forwarding isn't needed, but the router's firewall usually blocks connections from outside until you allow the port for that device.
How do I check if a port is in use on my computer?
On Windows, run netstat -ano | findstr :PORT in a terminal: the last number is the process ID, which Task Manager's Details tab names. On a Mac, run lsof -nP -i :PORT; on Linux, ss -ltnp. A port in use locally isn't necessarily reachable from the internet: check it here for that.
Which ports does Minecraft use?
Minecraft Java Edition servers listen on TCP port 25565 by default, which this checker can test. Bedrock Edition uses port 19132: current servers take a TCP handshake there and play over UDP, older ones use UDP only, so forward 19132 as TCP and UDP and test by joining from outside. Both ports can be changed in the server's settings.
Is this open port checker free, and is it legal to use?
It's free with no account: 60 ports a minute per network, and nothing about your checks is stored. Checking your own IP, router and servers is fine. Scanning systems you don't own or manage can break their terms or the law where you live, so only check what you have permission to test.
