How to Check if a Port Is Open (and What the Results Mean)

Updated 27 September 2026 · 6 min read

A port is a numbered entry point on a server, and each service (a website, remote desktop, a database) listens on a specific one. Checking whether a port is open tells you two things: whether something is listening, and whether every firewall in between lets you reach it. Here is how to test, and how to read the results.

What ports are, and the common ones

An IP address gets traffic to the right machine; the port gets it to the right program. Port numbers run from 0 to 65535, and the IANA port registry splits them into three ranges: system ports (0 to 1023), user ports (1024 to 49151) and dynamic ports (49152 to 65535), which are never assigned to a particular service.

TCP and UDP have separate sets of ports. Websites, email, SSH, RDP and databases use TCP. DNS, VoIP and many VPNs rely mostly on UDP. The methods in this guide, and our tool, test TCP.

These are the ports you'll meet most often, and whether they belong on the open internet:

Open, closed and timeout: what the results mean

A TCP test tries to complete the three-way handshake. The reply, or silence, tells you where the problem is.

• Open: the handshake completed. Something is listening and nothing in the path blocked you. It doesn't prove the service is healthy; port 443 can be open while the website shows a certificate error.
• Closed (refused): the host answered with a reset. The machine is reachable, but nothing is listening on that port, or a firewall is set to reject. Usually the service is stopped, listening on a different port, or listening only on 127.0.0.1.
• Timeout (no response): nothing came back at all. Packets were dropped silently, which is what most firewalls and cloud security groups do. It can also mean a wrong IP address or a host that's switched off. Scanners such as nmap call this state "filtered".

Rule of thumb: closed points at the server, timeout points at a firewall or routing.

Testing from inside vs outside the network

A test from the same network shows the service is running and the server's own firewall allows it. A test from outside shows the router, firewall and provider let traffic through. You usually need both.

One trap: testing your own public IP from inside your network can fail even when port forwarding works, because many home routers don't support "NAT loopback". Test from outside instead, with our tool or from a phone on mobile data.

Windows (PowerShell):

• Test-NetConnection 192.168.1.50 -Port 3389 and look for TcpTestSucceeded : True.
• Test-NetConnection example.com -Port 443 -InformationLevel Quiet returns just True or False.

Both forms are in Microsoft's documentation. Ignore PingSucceeded : False; many servers block ping while the port works fine. A failure doesn't say whether it was refused or timed out, but a long pause before the warning usually means packets are being dropped.

macOS and Linux: nc -zv -w 3 example.com 443. Here -z checks for a listener without sending data, -v prints the result and -w 3 gives up after three seconds (see the nc manual). Success prints a line ending in "succeeded"; failures look like this on the OpenBSD version many Linux distributions use:

• nc: connect to example.com port 443 (tcp) failed: Connection refused (closed)
• nc: connect to example.com port 443 (tcp) timed out: Operation now in progress (timeout)

The wording varies slightly between netcat versions. To see what is listening on the server itself, run Get-NetTCPConnection -State Listen on Windows or ss -tlnp on Linux.

Port forwarding and CGNAT

To reach a device at home or in a small office from outside, the router needs a port forwarding rule (sometimes called Virtual Server or NAT). A typical setup:

1. Give the device a DHCP reservation so its private address, say 192.168.1.50, never changes.
2. In the router, forward external TCP port 8443 to 192.168.1.50 port 443.
3. Allow the port in the device's own firewall, such as Windows Defender Firewall.
4. Test from outside against your public IP and port 8443.

If it still times out, compare the WAN address on the router's status page with the address our IP Checker shows. If they differ, something else is doing NAT in front of your router. It may be a second router you can also configure. If the WAN address is private or falls in 100.64.0.0/10 (the shared range from RFC 6598), it is carrier-grade NAT, and forwarding on your router can't work. Ask your provider for a public or static IP, or use a VPN or tunnel service that connects outward. Some providers also block certain incoming ports on home plans. More background is in What Is My IP Address?

Security: what not to expose

Automated bots scan every public IPv4 address constantly. Remote Desktop on 3389 is a favourite target for password guessing and a common way into company networks, so don't forward it. Use a VPN or a Remote Desktop Gateway with multi-factor authentication instead.

Database ports (3306, 1433, 5432) should never be reachable from the internet. Keep them on a private network, and do admin work over a VPN or SSH tunnel. If you must open a port, allow only known source IPs, use strong authentication and keep the software patched. After any change, test again from outside.

Check a port with our tool

The Port Checker tests from our server on Cloudflare's network, so it shows the outside view. Enter a hostname or public IP and a port, or paste a link such as https://example.com:8443/login and it picks out the host and port. Quick buttons cover common ports. You get Open, Closed or No response (after about five seconds), or Not allowed for targets it won't test.

Its limits:

• TCP only; UDP ports can't be tested.
• Public addresses only. Private and local addresses (10.x, 192.168.x, 127.0.0.1) are refused; test those from inside.
• Port 25 is blocked. Test 587 or 465 instead, or test 25 with Test-NetConnection or nc from a network that allows outgoing mail traffic.
• Our server can't open connections to addresses on Cloudflare's own network, so a site proxied through Cloudflare won't give a meaningful result. Test the origin server's IP.
• 20 checks per minute.

Only test servers you own or have permission to test.

Frequently asked questions

The port is open inside my network but times out from outside. Why?

Something between the internet and the server is dropping traffic: a missing port forward, a router or cloud firewall rule, carrier-grade NAT, or a provider block.

Does "closed" mean the server is down?

No. The server answered, so it is up. Nothing is listening on that port, or the service is bound to a different address or port.

Can I check UDP ports?

Not with our tool. UDP has no handshake, so silence could mean open or filtered. Test UDP services with their own client, such as a DNS query or the VPN app.

Is port checking allowed?

Checking your own systems is routine. Scanning systems you don't own without permission can break a provider's terms or local law.