How to check if a port is open
To check a port, you need two things: the public IP address of the network you are testing and the port number your app uses. Enter both, click Check Port, and read the status that comes back. The full check takes four steps:
- Find your public IP address on the CheckIP homepage.
- Enter that IP (or a domain) and the port, for example 25565 for a Minecraft Java server.
- Click Check Port.
- Read the result: open, closed or filtered.
Enter your public IP, not the 192.168 address your computer shows. Addresses such as 192.168.1.20 or 10.0.0.5 are private and only exist inside your home network, so a test from the internet cannot reach them.
People often search "what is my port", but each app listens on its own port: 80 and 443 for a web server, 22 for SSH, 25565 for a Minecraft Java server. Check the port in your app's settings.
Open, closed and filtered: what each result means
Open means an app is listening on the port and your router and firewall let the connection through. Closed means the connection reached the device, but no app was listening on that port. Filtered means no reply came back at all, usually because a firewall or your ISP dropped the request.
These terms come from Nmap's port scanning basics, and they map well to everyday cases.
- Open: you forwarded 25565 to your PC, the Minecraft server is running, and Windows allows it. Friends can join.
- Closed: the forwarding works, but the server app is not running, or it listens on 25566 instead. The device answers with a refusal.
- Filtered: the request disappears. A firewall rule drops it, the router has no forwarding rule, or your ISP blocks the port.
Closed is useful while you troubleshoot. Traffic reaches the device, so only the app side is left to fix.
Why your port shows closed after port forwarding
A port that still shows closed or filtered after you set up forwarding is almost always caused by one of six problems: the app is not running, a local firewall blocks it, the rule points to the wrong device, there are two routers, your ISP uses CGNAT, or your ISP blocks that port.
A port forward checker only shows the end result, so test each layer in turn:
- The app is not running or uses another port. Start the game server, camera or NAS service first, then confirm the port in its settings.
- The computer's firewall blocks it. On Windows, add an inbound rule for the port in Windows Defender Firewall. On a Mac, allow the app in the firewall settings. A test from another device on your Wi-Fi tells you if this layer is the problem.
- The forward points to the wrong local IP. Routers hand out local addresses by DHCP, and they change after a reboot. If the rule sends traffic to 192.168.1.20 and the PC is now 192.168.1.23, the port looks dead. Reserve a fixed local IP for the device in the router's DHCP settings.
- Two routers (double NAT). Many homes have an ISP modem-router plus a second Wi-Fi router. If your own router's WAN address starts with 192.168, 10. or 172.16 to 172.31, it sits behind another router. Forward the port on both, or put the ISP modem in bridge mode.
- Your ISP uses CGNAT. With carrier-grade NAT, many customers share one public IP and you cannot forward ports from home. To check, compare the WAN IP shown on your router's status page with the IP on the CheckIP homepage. If they differ, or the WAN IP falls in 100.64.0.0 to 100.127.255.255 (the shared address space reserved for carriers in RFC 6598), you are behind CGNAT. Ask your ISP for a public IPv4 address, often sold as a static IP add-on.
- Your ISP blocks the port. Some ISPs block common ports on home plans. Xfinity, for example, lists port 25 (SMTP) and port 445 (SMB) as blocked in both directions on its published list of blocked ports. Move the service to a higher port if the app allows it.
Common ports and whether to open them
Ports from 0 to 1023 are well-known ports assigned to standard services, and the full list is kept in the IANA port number registry. Open a port to the internet only when a service needs to be reached from outside, and keep remote-admin ports closed.
| Port | Protocol | Service | Open to the internet? |
|---|---|---|---|
| 21 | TCP | FTP (control) | Avoid; FTP sends passwords unencrypted |
| 22 | TCP | SSH | Only with key-based login |
| 23 | TCP | Telnet | No; unencrypted |
| 25 | TCP | SMTP (mail) | Only on a mail server |
| 53 | TCP/UDP | DNS | Only on a public DNS server |
| 80 | TCP | HTTP | Yes, on a web server |
| 443 | TCP | HTTPS | Yes, on a web server |
| 445 | TCP | SMB file sharing | No |
| 554 | TCP | RTSP (camera streams) | Better through the vendor app or a VPN |
| 3306 | TCP | MySQL | No; connect over SSH or a VPN |
| 3389 | TCP | Remote Desktop (RDP) | No; use a VPN |
| 5900 | TCP | VNC | No; use a VPN |
| 8080 | TCP | HTTP alternate | Only for a service you run on it |
| 25565 | TCP | Minecraft Java server (default) | Yes, for your own server |
| 19132 | UDP | Minecraft Bedrock server (default) | Yes, for your own server |
The Minecraft defaults come from the game's server.properties file. They are not IANA assignments. Pi Node ports aren't in the IANA list either; our Pi Node port forwarding guide shows where to find them.
Is port scanning legal?
Scanning your own IP, your own server or a network you have written permission to test is normal and legal practice. Scanning systems that belong to someone else is a gray area at best. ISPs and hosting companies can ban it in their acceptable use policies, and some countries treat it as preparation for an intrusion.
The legal issues chapter of the Nmap book notes that no US federal law explicitly makes port scanning a crime, yet people have still been arrested, sued or convicted over scans. It describes a 17-year-old in Finland convicted of attempted intrusion for port scanning a bank. Its main advice is to get written authorization before scanning any network you do not run.
CheckIP's terms of use allow scanning only of systems you own or have permission to test. For your home connection, that means your own public IP.
Online port scanner vs Nmap on your computer
An online port scanner tests your network from the outside, exactly as a friend joining your game server or a stranger probing your IP would see it. Nmap runs on a computer you control, so from inside your network it also sees ports that are only open on the LAN and never reach the internet. To check open ports on your own computer without Nmap, Windows, macOS and Linux have built-in commands.
Use the online check to confirm port forwarding and to see what you expose to the internet. Use Nmap when you need to scan a whole subnet, all 65,535 ports of a host, or identify which software version answers on a port. To scan only selected ports on your own public IP from a machine outside your network, a basic command looks like this (replace 203.0.113.5 with your IP):
nmap -Pn -p 22,80,443,25565 203.0.113.5
The -Pn option skips the ping step, which matters because many home routers do not answer ping. For reachability rather than ports, test latency to the same host with a ping check.
Frequently asked questions
Is my port open if the app is not running?
No. A port is only open while an app is listening on it. With the app stopped, a correctly forwarded port shows closed, because the device answers that nothing is there. If it shows filtered instead, the request never reached the device, so check the forwarding rule and the firewall before restarting the app.
Can this tool check UDP ports?
This port checker tests TCP ports. UDP is hard to test from outside, because a UDP service often sends no reply to an empty probe, and silence looks the same as a firewall drop. To test a UDP service such as a Minecraft Bedrock server on 19132, try connecting with the real client from a mobile connection.
Why does my port show closed even after port forwarding?
The forwarding rule is only one of several layers. The app must be running on that exact port, the computer's firewall must allow it, the rule must point to the device's current local IP, and your ISP must give you a real public IP. Go through the six checks in the troubleshooting section above in order.
Can I check a domain instead of an IP address?
Yes. Enter the domain and the tool resolves it to an IP before testing the port. For a home server on a dynamic DNS name, this confirms that the name points to your current IP. If the domain sits behind Cloudflare or another proxy, you test the proxy's ports, not your server's.
Is it safe to leave a port open?
An open port is only as safe as the app behind it. A patched game server on 25565 is a normal setup. Remote Desktop on 3389 or SMB on 445 open to the whole internet puts a login screen or file share in front of anyone who finds your IP. Close ports you no longer use, and put admin access behind a VPN.
What is the difference between a port checker and a port scanner?
A port checker tests one or a few ports you name, to answer one question: is this port reachable? An ip port scanner goes through a range or list of ports on a host to map everything that answers. The open, closed and filtered results mean the same in both.