Open Port Checker

The service behind the port must be running while you test it. An open router rule by itself is not enough: the destination device also needs a TCP application listening on that port.

1. Start the server or application you want to reach and confirm that it is listening on the expected TCP port.
2. Select a common port above, or add any custom port from 1 to 65535. For example, use 25565 for a Minecraft Java server or 3000 for a development server.
3. Choose Check selected ports. Open confirms an outside connection; closed or filtered tells you which layer to investigate next.

This tool checks TCP reachability only. UDP is connectionless and needs a protocol-specific test, so a silent UDP service cannot be classified accurately with a normal TCP handshake.

• Open: a service answered from the public internet on that port. Port forwarding and firewall rules are working.
• Closed: your host is reachable but nothing is listening on that port. The forward may be missing, the app is not running, or the wrong internal device is targeted.
• Filtered: no response at all. A firewall, your router, or carrier-grade NAT is dropping the connection before it reaches you. This is the classic CGNAT symptom.

If ports stay filtered no matter what you forward, the problem is usually upstream of your router. Confirm it with the CGNAT test and compare your router WAN IP with your public IP.

A fresh connection is blocked by default at every layer, so "filtered" is the normal result until you deliberately open a path. Three things must all be true at the same time, and missing any one of them keeps the port closed or filtered:

1. Something must be listening. Start the service first. For a quick test with no setup, run python -m http.server 8080 in a terminal. Confirm it is bound to the port with netstat -ano | findstr :8080 on Windows, or ss -tlnp | grep 8080 on Linux and lsof -i :8080 on macOS.
2. The device firewall must allow it in. On Windows, add an inbound rule for the TCP port (Windows Defender Firewall, Advanced settings, Inbound Rules, New Rule, Port). Third-party security suites such as ESET, Kaspersky, or Norton keep their own separate firewall, so check there too.
3. The router must forward the port. Find your device LAN IP (ipconfig on Windows, ip addr on Linux), then add a port-forward rule in the router admin page pointing the external port to that LAN IP and port. The router login guide covers finding that page.

Turning off your antivirus alone will not change the result. An inbound connection reaches your ISP, then your router, and only then your computer. Without a forwarding rule the router discards the packet first, so your PC and its security software never see it. That is why a port stays filtered even with all local protection disabled. Re-enable your firewall afterwards and remove any forwarding rule you no longer need.

Once all three layers are set, re-run the check on that port. If it turns open, the path works end to end. If it is still filtered, the block is upstream of your router: confirm with the CGNAT test or check whether your ISP blocks that port.

You can test any TCP port from 1 to 65535. These are common ports people check after changing a firewall rule, router forward, game server, database, or self-hosted application.

An open result confirms that a TCP listener answered. It does not prove the service is securely configured, authenticated, or safe to expose. Close unused forwards and protect every public service.

When you pick a port, we open a TCP connection to your public IP on that port from our server and watch what happens:

1. The connection completes, so a service is listening and the port reads as open.
2. The connection is actively refused, so the host is reachable but nothing is listening - the port is closed.
3. Nothing answers before the timeout, so a firewall or NAT is silently dropping it - the port is filtered.

For privacy and safety, this tool only ever scans your own public IP, read from your connection at the edge. It cannot be pointed at anyone else, so it is a diagnostic for your own port forwarding, not a scanner for third-party hosts.