How to Check if a Port Is Open (From Outside Your Network) | Check Host
Learn how to test whether a TCP port such as 22, 443, 3389 or 25565 is open and reachable from the internet, and how to fix the usual reasons it is not.
You started a server, opened a port in your firewall, forwarded it on your router — and nobody can connect. Testing the port from your own machine does not help: it bypasses the router, the ISP and every firewall in between. To know whether a port is really open, you have to test it from the outside.
What "open" actually means
A TCP port is open when something is listening on it and a connection from the internet can complete the TCP handshake. Three things must all be true:
- A program is listening on that port, bound to the right interface (not only
127.0.0.1).
- The host's firewall allows incoming connections on that port.
- Every network device in front of the host — router, NAT, cloud security group — forwards or allows the traffic.
Test it from many countries at once
The port checker attempts a TCP handshake to your host and port from servers around the world and reports the connect time from each. Enter a hostname or IP and a port, for example example.com and 443.
- Connected everywhere — the port is open to the internet.
- Timeout everywhere — packets are being dropped silently, usually by a firewall or a missing port forward.
- Refused everywhere — the host is reachable but nothing is listening on that port.
- Mixed results — geo-blocking, a regional routing issue, or a DDoS protection layer filtering some networks.
Common ports worth knowing
| Port | Service |
|---|
| 22 | SSH |
| 25 / 587 | SMTP (mail) |
| 80 / 443 | HTTP / HTTPS |
| 3306 / 5432 | MySQL / PostgreSQL |
| 3389 | Windows Remote Desktop |
| 25565 | Minecraft Java server |
Why a port shows as closed
- Listening on localhost only. Check with
ss -tlnp (Linux) or netstat -an (Windows); the local address should be 0.0.0.0 or ::, not 127.0.0.1.
- Host firewall. ufw, firewalld, iptables or Windows Defender Firewall blocks it.
- Cloud security group. AWS, GCP, Azure and most VPS providers have their own firewall in front of the machine.
- Missing port forward. Behind a home router, the port must be forwarded to your machine's LAN IP.
- CGNAT. Many ISPs share one public IP between customers. If your router's WAN IP differs from your public IP (see the IP lookup), port forwarding cannot work.
- ISP blocking. Residential ISPs often block 25, and sometimes 80 or 445.
Only TCP is tested
A TCP check cannot tell you whether a UDP port (DNS on 53, WireGuard, many game servers) is open: UDP has no handshake, so a silent port and a filtered one look the same. Test UDP services with a client for that protocol.