Open Port Checker
Check whether one TCP port on your own address accepts connections from the internet, and read open, closed or filtered.
The ports this tool offers
| Port | Service | Why it is on the list |
|---|---|---|
| 21 | FTP | Plain-text file transfer. Deprecated for anything on the public internet. |
| 22 | SSH | Remote shell. Safe to expose with key-only authentication. |
| 25 | SMTP | Mail relay between servers. Most consumer ISPs block it in both directions. |
| 53 | DNS | Name resolution. An open recursive resolver is an amplification risk. |
| 80 | HTTP | Web without TLS. Usually only a redirect to 443. |
| 110 | POP3 | Legacy mail retrieval without TLS. Superseded by 995. |
| 143 | IMAP | Mail access without TLS. Superseded by 993. |
| 443 | HTTPS | Web over TLS. The port almost every network allows outbound. |
| 465 | SMTPS | Implicit TLS mail submission. |
| 587 | Submission | Mail submission with STARTTLS. The port a mail client should use. |
| 993 | IMAPS | Mail access over TLS. |
| 995 | POP3S | Mail retrieval over TLS. |
| 3306 | MySQL | A database open to the internet is a finding, not a success. |
| 3389 | RDP | Remote desktop. A primary ransomware entry point when exposed. |
| 5432 | PostgreSQL | Should sit behind a VPN or an address allowlist. |
| 8080 | HTTP alternate | Proxies, admin panels and application servers. |
| 8443 | HTTPS alternate | TLS admin panels and application servers. |
One port per request.3 second connect timeout.Any single port from 1 to 65535 can be entered as well.
Getting a network removed from this tool
Any network operator can have their addresses excluded. Write to abuse@whatsmyip.fyifrom an address in the WHOIS or RDAP record for the range, name the prefixes, and they go on the exclusion list. Every check reads that list before it opens a socket, so the exclusion takes effect immediately and no appeal or renewal is needed. Report abuse of this tool to the same address, with the timestamp and the target.
Third-party targets are limited to 10 a day, a challenge appears after 10 checks in a day, and we keep a hashed source prefix with a hashed target so those complaints can be answered. No raw address is written to any log we keep.
Acceptable use
This tool checks systems you own or have written permission to test. That is the rule, and it is in the terms of service.
- One port per request. There is no range scan, no port list upload, and no “scan common ports” button that fires fifty connections. This is deliberate and will not change.
- Rate limits. Five ports per minute and thirty per day per source address. A bot challenge appears after ten checks in a day. Third-party targets are limited to ten per day.
- Logging for third-party targets. When the target is not your own address, we record a hashed source and target with a timestamp. That record exists so abuse complaints can be answered.
- Blocklist. Any network operator can ask to have their ranges excluded from this tool. Write to abuse@whatsmyip.fyi and it will be added.
Report abuse of this tool to abuse@whatsmyip.fyi. Include the timestamp and the target address.
Why the result can differ from your own test
The connection originates at our edge, from a datacenter address. Some firewalls treat cloud ranges differently from residential ones, and some ISPs filter inbound ports such as 25, 80, and 445 on consumer lines regardless of your router configuration. A port that is open from your phone on mobile data and filtered from here usually means a policy filter rather than a broken rule.
Debugging a forwarded port
Work outward, one layer at a time.
- The service. Confirm it listens on 0.0.0.0 or the LAN address, not on 127.0.0.1.
- The host firewall. Windows Defender Firewall and ufw both block inbound by default.
- The router rule. Check the internal address in the rule still matches the device, which DHCP may have changed. A static lease avoids this.
- The ISP. Check for CGNAT and for blocked ports on consumer plans.
If steps one through three are correct and the result is still filtered, step four is the answer.
About this tool
This opens one TCP connection from our edge to one port on the target address and reports open, closed, or filtered. The default target is your own public address, which makes it a way to confirm that a port forward on your router works from outside. You get a curated list of common ports plus one port you can type. It is one port per request, with a three second connect timeout, and there is no range scanning.
How to read the result
- Open
- The TCP three-way handshake completed. Something is listening on that port and it is reachable from the public internet through every device in the path, so the forwarding works.
- Closed
- The connection attempt received a TCP RST, so a host answered and refused. The packet reached your network, but nothing is listening on that port, and this is a definite answer.
- Filtered
- Nothing answered before the three second timeout, so a firewall dropped the packet silently at your router, at your ISP, or on the host. Closed proves a host replied, while filtered proves nothing about what sits behind the filter.
- Unavailable
- Our platform refused to open the socket, so no packet ever reached the target, and it blocks outbound connections on some ports, port 25 among them. This row means the tool could not test, not that the port is shut.
- Target address
- The address we tested, shown on every result. Behind CGNAT your public address belongs to your carrier and is shared with other subscribers, so forwarding a port on your own router cannot make it reachable.
- Common port meanings
- 22 is SSH, 80 and 443 are HTTP and HTTPS, 25, 465, and 587 are SMTP submission, 3389 is RDP, 3306 is MySQL, and 5432 is PostgreSQL. An open 3389, 3306, or 5432 facing the public internet is a configuration to reconsider rather than a success.
Questions people ask
- Why does every port show filtered even though I forwarded them?
- The most common cause is carrier-grade NAT. If your public address is inside 100.64.0.0/10, or your router WAN interface shows a private address while your public address is different, your ISP shares one address across many subscribers and inbound forwarding cannot reach you. Ask the ISP for a public address, or use a tunnel service.
- What is the difference between closed and filtered?
- Closed means a host actively refused with a TCP reset, which proves the packet arrived. Filtered means silence, which means something dropped it and gave no reason. When you are debugging a firewall, that distinction tells you whether the packet is getting through at all.
- Can I scan someone else's server with this?
- You can check a third-party address, under harder rate limits and with the source and target recorded, but only where you own the system or hold permission to test it. That is a term of use, not a suggestion. Range scanning is not available at all.
- Does an open port mean I am at risk?
- It means a service is reachable. Whether that is a risk depends on the service, its version, and its authentication. A well-maintained SSH server on port 22 with key-only authentication is fine. An unauthenticated database on 3306 is not. The port number alone is not a verdict.
- Why can I connect locally but the check says closed?
- A service bound to 127.0.0.1 accepts local connections and nothing else. Check what address the service listens on, then check the host firewall, then check the router forwarding rule. Working through those three in order finds nearly every case.
Related
Last reviewed 2026-09-05.