Security ToolTCP / Firewall Audit

Port Checker — Test Open Ports & Router Port Forwarding

A port checker is a network accessibility utility that scans specific TCP and UDP port numbers on an IP address to verify whether they are open, closed, or filtered by a firewall. It validates router port forwarding rules and confirms whether local servers or devices are reachable from the public internet.

Live Port Scanner & Firewall Prober

Test if external inbound connection ports are open or filtered on your router and firewall.

Port Protocol Info: Port 80

Used for standard unencrypted website traffic. Safe to forward for public web servers.

Standard encrypted protocol. Recommended for server applications.

Transport Layer Port Ranges & TCP Handshake Mechanics

TCP/IP networking divides socket communication into 65,535 individual port numbers governed by the Internet Assigned Numbers Authority (IANA). The port spectrum is partitioned into three standardized tiers:

Standard IANA Port Number Allocations:

  • Well-Known Ports (0 – 1023): System core services (e.g., Port 80 HTTP, Port 443 HTTPS, Port 22 SSH, Port 53 DNS)
  • Registered Ports (1024 – 49151): Vendor applications and databases (e.g., Port 3306 MySQL, Port 25565 Minecraft, Port 32400 Plex)
  • Dynamic / Private Ports (49152 – 65535): Temporary ephemeral client sockets allocated during outbound web browsing sessions

Citable TCP Handshake Logic: When probing a port, the scanner transmits a SYN packet. An Open status occurs when the server returns SYN-ACK, proving the application is bound to that socket. A Closed status returns RST, while a Filtered status indicates packets were silently dropped by a stateful firewall without reply.

Real-World Port Forwarding Use Cases

1. Self-Hosting Home Media & Game Servers

When hosting a multiplayer game server (e.g. Minecraft on port 25565) or Plex Media Server (port 32400), this tool confirms your router's virtual server rule correctly maps external WAN traffic to your internal PC IP (e.g. 192.168.1.150).

2. Security Audits & Malware Vulnerability Scans

Perform regular boundary audits to guarantee dangerous administrative ports—such as Telnet (Port 23), SMB (Port 445), and unencrypted database ports—are not exposed to malicious internet port scrapers.

How to Interpret the Port Checker Output

Port is OPEN: External packets successfully crossed through your router NAT table and received an active handshake from the server software on that machine.
Port is CLOSED / FILTERED: The request timed out or received a reset flag. This indicates the server app is closed, the router port forwarding IP mapping is wrong, or your ISP utilizes Carrier-Grade NAT (CGNAT).

Frequently Asked Questions

Why does a port show as closed even after configuring router port forwarding?

A port tests as closed if the listening server application (like Plex or Minecraft) is offline, if local host firewall rules block inbound traffic, or if your internet provider deploys Carrier-Grade NAT (CGNAT).

Which common ports should remain closed for home network security?

You should never expose Port 23 (Telnet), Port 445 (SMB file sharing), or Port 3389 (Windows Remote Desktop) directly to the public internet without wrapping them inside an encrypted VPN tunnel.

Do residential internet service providers block specific ports?

Yes, many consumer ISPs block outbound Port 25 (SMTP) to eliminate spam botnets and inbound Port 80 (HTTP) or 443 (HTTPS) to prevent customers from operating commercial web servers on residential contracts.