How to Check If a Port Is Open and What to Do If It Isn't

To check if a specific network port is open and accessible from the public internet, use an online port verification utility like the MyIPChecker Port Checker, or execute native operating system commands like Test-NetConnection in Windows PowerShell or nc -zv (Netcat) on macOS and Linux. If a port is reported as closed or filtered, you can resolve the issue by: 1) Verifying that the target service is actively running and listening on all interfaces (0.0.0.0), 2) Creating a Port Forwarding rule in your router firmware, 3) Opening an inbound firewall rule in your operating system, and 4) Checking whether your ISP blocks common incoming ports.

Network ports are fundamental communication endpoints that allow operating systems to distinguish between concurrent network applications—such as directing web traffic to port 80/443, email to port 25, and SSH remote management to port 22. When setting up a home media server (Plex), a multiplayer game server (Minecraft), or a security camera feed, ensuring the required port is open to external traffic is a vital requirement. This guide outlines how port checking functions and details the exact steps to diagnose and open closed ports.

Understanding Port States: Open vs. Closed vs. Filtered

When an online port checker or security scanner tests a port, it transmits a TCP SYN packet (the first step of the TCP three-way handshake). The target device responds in one of three ways:

1. Open (Listening): The target device receives the SYN packet and replies with a SYN-ACK packet. This confirms that an application is actively listening on that port number and perimeter firewalls permit external inbound connections.
2. Closed: The target machine receives the SYN packet and immediately replies with a RST (Reset) packet. This indicates that traffic successfully reached the machine through the router and firewall, but no application or server software is currently running and listening on that port.
3. Filtered (Blocked / Timed Out): The scanner receives no reply, and the connection attempt times out after several seconds. This signifies that an intermediary firewall—such as your broadband router, operating system firewall, or ISP filter—silently dropped the packet without replying.

You can test whether critical ports are reachable on your public IP using our free Open Port Checker Tool.

Common Network Service Ports Reference Table

The Internet Assigned Numbers Authority (IANA) manages 65,536 available TCP and UDP ports. The table below highlights the most common ports used by developers, sysadmins, and gamers:

How to Check If a Port Is Open: Command Line Methods

In addition to using our web-based port checking utility, you can test port reachability directly from your local terminal:

On Windows 10 & 11 (PowerShell):

Modern Windows includes a powerful native cmdlet that replaces legacy Telnet:

Test-NetConnection -ComputerName 192.168.1.100 -Port 80

If the port is open and listening, PowerShell will output: TcpTestSucceeded : True.

On macOS and Linux (Netcat):

Open a terminal window and run Netcat with the zero-I/O (-z) and verbose (-v) flags:

nc -zv 192.168.1.100 22

If open, Netcat will report: Connection to 192.168.1.100 port 22 [tcp/ssh] succeeded!.

Troubleshooting: 4 Reasons a Port Shows "Closed" and How to Fix It

If your port test reports closed or timed out, methodically resolve these four common network roadblocks:

Roadblock 1: The Application Is Not Actively Running or Bound to 127.0.0.1

A port cannot be "open" in the abstract; an application must actively bind to the network socket. Furthermore, if your application is configured to listen strictly on the loopback address (127.0.0.1 or localhost), it will reject connections originating from other devices. Ensure your server software (e.g., Apache, Nginx, or Minecraft) is bound to 0.0.0.0 (all network interfaces).

Roadblock 2: Missing Router Port Forwarding

Because consumer routers utilize Network Address Translation (NAT), incoming packets from the public internet do not know which computer on your local Wi-Fi to reach. You must establish an explicit Port Forwarding rule:

1. Log into your router's administration portal (e.g., 192.168.1.1).
2. Navigate to Advanced > Port Forwarding / Virtual Server.
3. Create a new rule: enter the external port (e.g., 25565), the protocol (TCP/UDP), and the static private IP of your host computer (e.g., 192.168.1.150).
4. Save settings and apply. Your router will now forward all incoming packets on that port directly to your computer.

Roadblock 3: Operating System Firewall Dropping Packets

Even if your router forwards the packet correctly, your operating system's local firewall (Windows Defender Firewall or Linux iptables/ufw) will block unsolicited inbound connections by default:

1. On Windows, open Windows Defender Firewall with Advanced Security.
2. Click Inbound Rules in the left sidebar, then click New Rule... in the right sidebar.
3. Select Port, choose TCP, enter your port number, select Allow the connection, and apply.

Roadblock 4: ISP Inbound Port Filtering and Carrier-Grade NAT (CGNAT)

If you have configured router port forwarding and local firewalls correctly but the port remains blocked, your ISP is the culprit. Many residential broadband providers block ports 80, 443, and 25 to prevent residential users from hosting public web or mail servers. Furthermore, if your ISP uses Carrier-Grade NAT (CGNAT), your home router does not possess a true public IP address, making standard port forwarding technically impossible without setting up an SSH reverse tunnel or a VPN with port-forwarding support.

To learn how default gateways manage traffic across subnets, consult our guide on What Is a Default Gateway?.

For best practices on securing exposed ports against automated attacks, explore our guide: How to Secure Your Home Network in 30 Minutes.