Open Port Checker

Open Port Checker

Enter a domain or IP address in Host and the ports to test in Ports, then click Check ports. You can check up to twenty ports at once, written however is easiest:

• single ports and ranges: 22, 80, 443, 8000-8010
• service names: ssh, https, mysql
• a port in the host itself: example.com:8443 or https://example.com/ sets the port when the Ports field is empty

The Sets fill the list with a group in one tap: Common, Web, Mail, Remote access or Databases. The port chips below them add single ports.

Each port comes back as open, closed, filtered or unreachable, with the response time. If the service introduces itself, its first line is shown too. To keep the tool from being used as a scanner against other people’s servers, each visitor can check up to 200 ports per ten minutes.

Example: 8.8.8.8

Twelve common ports checked on Google Public DNS:

Two open, ten filtered. That’s what a well-run public server looks like: only the services it offers answer, and everything else is silently dropped.

Both open ports are DNS. Port 53 is ordinary DNS over TCP, and port 443 is DNS over HTTPS, the encrypted DNS that browsers use. Add 853 and you’ll find DNS over TLS too. The 2 ms response means our server sits close to one of Google’s: 8.8.8.8 is answered from many places at once.

Open, closed, filtered, unreachable

Most port checkers only say “open” or “closed”. The four states here tell you where the problem is:

Closed and filtered need opposite fixes. Closed means your firewall and port forwarding are fine, and the problem is the service. Filtered means the service may be fine, but something on the way is blocking it.

Checking port forwarding

You’ve set up a game server, a NAS or a camera at home and want to reach it from outside. Enter your public IP from What’s My IP and the port, then read the state:

• Open: it works. If your app still can’t connect, check that it uses the same port and address.
• Closed: the router passes the traffic on, but nothing on the device answers. The service isn’t running, uses another port, or listens only on 127.0.0.1 (the device itself). Many servers do that by default; set it to listen on all addresses.
• Filtered: something drops the traffic before it gets there. Work through:
  1. The port forward on the router: right port, right device, right protocol (TCP).
  2. The device’s own firewall, such as Windows Firewall or ufw.
  3. Carrier-grade NAT. If the WAN address in your router doesn’t match your public IP, or starts with 100.64 to 100.127, port forwarding can’t work until your provider gives you a public address.
  4. Your provider. Some block common ports on home connections, especially 25 and sometimes 80.

A Minecraft Java server, for example, uses TCP port 25565 and can be checked here. Bedrock Edition uses UDP port 19132 and can’t, for the reason below.

What the service said

Some services speak first: they send a greeting as soon as the connection opens. When they do, the first line appears in What the service said. For example:

• SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.5 from an SSH server
• 220 mail.example.com ESMTP Postfix from a mail server

Nothing is sent to the service. The tool only reads what it volunteers. That’s useful for confirming the right software answers on a port. It’s also a reminder that the greeting tells everyone your software and version, so keep that software up to date.

Web servers don’t speak first, so ports 80 and 443 show no greeting.

Hosts behind Cloudflare or a firewall

If a domain is behind Cloudflare or a similar service, you’re checking Cloudflare’s servers, not yours. Only web ports answer: 80 and 443, plus a handful of other ports Cloudflare passes on, such as 8080 and 8443. Everything else shows as filtered, even if it’s open on your server. The notes point out this web-only picture.

To check SSH or mail on such a server, enter its real IP address, or a subdomain that isn’t proxied, instead of the main domain.

Ports that shouldn’t be open to everyone

The notes warn when a database or remote-desktop port is open:

• Databases: MySQL 3306, PostgreSQL 5432, SQL Server 1433, MongoDB 27017, Redis 6379.
• Remote desktop: RDP 3389, VNC 5900.
• Telnet (23) sends everything, passwords included, unencrypted.

These are scanned constantly by bots trying passwords and known vulnerabilities, and exposed RDP is a common way into ransomware attacks. Unless the whole internet needs to reach them, close them to the outside. Allow only your own IP addresses in the firewall, or reach them through a VPN or an SSH tunnel.

A name with several addresses

When a domain has more than one address, often an IPv4 and an IPv6 one, the notes say which address was checked and list the others. Firewall rules for IPv4 and IPv6 are set separately, and it’s common for a port to be closed on one and open on the other. Enter the other address to check it too. Hostname to IP lists all of them.

What it can’t check

• UDP ports. UDP has no handshake, so a silent UDP port looks the same whether a service is listening or not. That covers DNS over UDP, WireGuard and OpenVPN, voice chat and most games.
• Ports as your own connection sees them. The attempts come from our server. A firewall that only allows certain addresses will show those ports as filtered here, even if they’re open for you.
• Private addresses. 192.168.x.x, 10.x.x.x and similar addresses only exist inside a local network. To check ports inside your network, use a tool on a computer in the same network, such as nmap.

FAQ

Which ports should I check?

Use the sets: Web for a website, Mail for a mail server, Remote access for SSH and RDP, Databases to make sure none are exposed. For a game or app, check the port its documentation names.

My port shows filtered, but the service works for me. Why?

Either your firewall allows your address and not ours, or you’re testing from inside your own network, where the router doesn’t need port forwarding. Ask someone outside your network to test, or use mobile data.

Is it legal to check ports?

Checking your own servers is routine, and checking a handful of ports on a public service is what happens every time you connect to it. Scanning other people’s networks without permission is another matter, which is why each visitor’s checks are limited.

Is it safe to leave port 22 (SSH) open?

Usually, if you log in with keys rather than passwords and keep the server updated. Expect a constant stream of login attempts in the logs. Tools like fail2ban, or limiting access to known addresses, cut the noise.