Open Port Checker

Checks which TCP ports on a server accept connections from the public internet, which is the part you cannot test from inside your own network. A port that answers from your laptop may be firewalled to the world, and the reverse — a database quietly listening on a public address — is the problem worth finding.

Up to twelve ports per check. Nothing is sent to an open port and no banner is read: this reports whether something is listening, not what it is.

How it works

A TCP port check is one handshake. This server sends a SYN; a listening service answers SYN-ACK and the port is open. If nothing is listening the operating system replies with RST and the port is closed — a definite, immediate answer. If a firewall silently drops the packet there is no reply at all and the connection times out, which is reported as filtered.

That three-way distinction is more useful than it looks. "Closed" means your server is reachable and simply is not running that service — the network path is fine. "Filtered" means something between here and there is dropping traffic, which is what a correctly configured firewall does. Diagnosing a service that will not connect, "closed" points at the service and "filtered" points at the firewall.

Which ports should be open depends entirely on the machine's job. A web server needs 80 and 443 and, realistically, nothing else facing the public. What should almost never be open to the whole internet: 3306 (MySQL), 5432 (PostgreSQL), 6379 (Redis), 27017 (MongoDB), 3389 (Remote Desktop) and 5900 (VNC). Redis and MongoDB are the notorious pair, because historically both shipped with no authentication at all — exposed instances have been mass-ransomed repeatedly. Bind them to localhost, or to a private interface, and reach them through a VPN or an SSH tunnel.

SSH on 22 being open is normal and fine, provided password authentication is off and keys are used. Moving it to a high port stops log noise from automated scanners but is not security in itself — anyone doing a real scan finds it in seconds.

One caveat specific to shared hosting. Many providers block outbound port 25 from their servers to limit spam, so a check of port 25 from here may report filtered even though your mail server is reachable from elsewhere. That is a limitation of where this check originates, not a finding about your server, and it is called out in the result when it applies.

Frequently asked questions