What the three results mean
Our probe opens a TCP connection to each port from outside your network and reports what happened.
| Result | What happened | Usual cause |
|---|---|---|
| Open | Something accepted the connection | Forwarding works and a program is listening |
| Closed | The device answered and refused | The port reaches a device, but nothing is listening on it |
| Filtered | No reply before the timeout | A firewall or router dropped the packet, or the provider blocks the port |
When a forwarded port still shows closed
- Nothing is listening. Start the game server, camera or application first. Forwarding to a port with no program behind it looks closed.
- The device firewall blocks it. Windows Defender Firewall and macOS both block inbound connections until you allow the program.
- The rule points at an old address. If the device got a new local address from the router, the rule now points at nothing. Reserve its address in the router's DHCP settings.
- You are behind carrier-grade NAT. If your router's WAN address starts with
100.64to100.127, or differs from the address shown on this page, your provider shares one public address among many customers and inbound ports cannot reach you. Ask the provider for a public address. - Your provider blocks the port. Residential connections often have 25, 80, 135 to 139 and 445 blocked.
Ports people check most
| Port | Service | Used for |
|---|---|---|
| 22 | SSH | Secure remote shell and file transfer |
| 80 / 443 | HTTP / HTTPS | Web servers |
| 3389 | RDP | Windows Remote Desktop |
| 25565 | Minecraft | Java Edition game server |
| 32400 | Plex | Media server remote access |
| 51820 | WireGuard | VPN (UDP, which this TCP check cannot see) |
Only test addresses you own or have permission to test. Each check is limited to ten ports.