Open Port Checker
Check whether specific ports are reachable on a host from outside your network. Up to ten ports per check, with the usual service named.
Runs on our server: what you enter is used for the lookup, not stored.
This check runs from our server, not from your browser, and is rate limited. Nothing you enter is stored. Private and internal addresses are refused on purpose.
What this tool is for
Checks whether a port accepts connections from outside, which is the question behind most firewall debugging: the service is running, but is it reachable. Up to ten ports at a time, no ranges. That limit is deliberate, since a tool that scans ranges is a tool for scanning other people networks. This is one of the few tools here that needs a server, because the question is about the internet rather than about your data. The request is made from our server, rate limited, and nothing you enter is stored.
Common ports and what runs on them
| Port | Service | Should it be public? |
|---|---|---|
| 22 | SSH | Only with key login; better limited to your IP |
| 25 | SMTP between mail servers | Yes on a mail server, otherwise no |
| 80 | HTTP | Yes on a web server |
| 443 | HTTPS | Yes on a web server |
| 587 | SMTP submission | Yes on a mail server |
| 3306 | MySQL, MariaDB | No |
| 5432 | PostgreSQL | No |
| 6379 | Redis | Never, it is a common breach vector |
| 27017 | MongoDB | Never |
| 3389 | Windows Remote Desktop | No, use a VPN |
| 8080, 8443 | Alternative HTTP, admin panels | Usually no |
Why a port shows closed when the service is running
The service listens only on localhost. Databases and many development servers bind to 127.0.0.1 by default, which accepts connections from the same machine only. Check with ss -tlnp or netstat -an: 0.0.0.0 means every interface, 127.0.0.1 means local only.
A firewall is in the way. On the server itself that is ufw, firewalld or iptables; at a cloud provider it is the security group or cloud firewall, which is a separate setting from the server firewall and a frequent surprise.
The router does not forward the port. A device on a home network sits behind the router, which needs a port forwarding rule pointing the outside port at the device local address. If your ISP uses carrier grade NAT, port forwarding cannot work at all; the router WAN address will differ from your public IP.
The ISP blocks it. Many residential providers block outgoing and incoming port 25 to stop spam, and some block 80 and 443 on home connections.
Refused, timed out and open
Open means the connection was accepted. Refused means the machine answered but nothing listens on that port, so the network path is fine and the service is not running or is bound elsewhere. Timed out means nothing answered, which usually points at a firewall dropping packets silently.
How to use it
- Enter the host you are responsible for.
- List the ports to check, separated by commas.
- Read which answered, which refused and which timed out: the difference matters.
Frequently asked questions
What is the difference between refused and timed out?
Refused means the host answered and nothing is listening: the port is closed but reachable. Timed out means no answer at all, which usually means a firewall dropped the packet silently.
Why can I only check ten ports?
Because port scanning other people infrastructure is what this kind of tool gets used for. Ten ports covers legitimate debugging and is useless for a sweep.
Which ports should not be open to the world?
Databases above all: 3306, 5432, 27017, 6379. Also 22 unless you have hardened it, and any admin panel. If you find these open on your server, that is today problem.