This query runs from our servers

Check Whether a Port Is Open or Closed

Check that a service on your server can be reached from outside your network.

How to use it

  1. Enter your server's domain name or IP address.
  2. Enter ports separated by commas, or pick a preset such as web or mail ports.
  3. Press Check and review each port's status.

After setting up a website, mail server or database, the question is whether it can actually be reached from the internet. Testing from inside your own network doesn't answer that, because a firewall or router may allow connections from inside and block them from outside. This tool connects from our server — from outside your network, exactly as a visitor would.

There are three results, not two. “Open” means a service accepted the connection. “Closed” means the server answered and refused because nothing is listening on that port. “Filtered” means no answer came back within three seconds — usually a firewall silently dropping the connection. Telling closed from filtered is what tells you where the problem is.

To limit abuse, you can check at most ten ports at a time, ranges aren't accepted, and internal or private addresses are refused. The tool is meant for checking your own servers.

Frequently asked questions

“Closed” means the server replied refusing the connection because nothing is running on that port — the network is fine, the service isn't started. “Filtered” means no reply at all, usually a firewall on the server or at your hosting provider.

Usually because you're testing from inside the same network. Check port forwarding on your router, your firewall rules, and security groups if the server runs on a cloud provider such as AWS.

Many cloud providers, AWS among them, block outbound connections on port 25 by default to fight spam. If port 25 shows as filtered, the restriction may be on our side rather than yours. Try port 587 to check a mail server instead.

It's meant for your own servers or ones you're authorised to test. We cap the ports per request and the request rate, and refuse internal addresses, so it can't be used as a network scanner.