Port Checker
Free port checker that tests whether one TCP port on your own IP address accepts connections from the internet, with the timeout stated.
Updated
A number from 1 to 65535. The address checked is your own.
Enter a port number and select Check.
What Is a Port Checker?
The port checker tries one TCP connection from the internet to your own IP address on the port you choose and reports what happened: the connection was accepted, it was refused, or nothing answered within 5 seconds. It checks only the address your request comes from, so it tests your own port forwarding and firewall rules and cannot be pointed at anyone else.
How to Use the Port Checker
- Enter a port number, or pick one of the common ports.
- Press Check. The connection attempt comes from Cloudflare's network and takes up to 5 seconds.
- Read the result, then open the line under it for what to check next.
- Change your router or firewall and check again; results are never cached.
How It Works
The checker takes your IP address from the CF-Connecting-IP header, which Cloudflare sets to the address of the client that connects to it. It never reads an address from the form, so it can test only the network the request comes from.
It then opens one TCP connection from Cloudflare's network to that address and port. The connection counts as accepted when the socket's opened promise resolves, which happens once the connection is established. The checker closes it at once and sends no data.
Under RFC 9293, a host that has no program listening on a port answers a connection attempt with a reset, so a refused connection usually means that something at your address answered but nothing listens on the port, or a firewall rejects the attempt. When nothing answers within 5 seconds, a firewall may be dropping the packets, the router may have no forwarding rule, or the connection may sit behind a provider's carrier-grade NAT, which RFC 6598 gives its own shared address space.
Cloudflare Workers cannot open connections to port 25 or to Cloudflare's own IP addresses, so those cannot be checked.
Standard
Scope
What It Checks
- +Checks one TCP port on the IP address your request comes from.
- +Reports accepted, refused, or no reply within 5 seconds, with the time taken.
- +Explains what each outcome usually means and what to check next.
- +Never accepts a target address, so it cannot test anyone else's network.
What It Does Not Check
- -It does not check UDP ports.
- -It does not check port 25, which Cloudflare Workers cannot connect to.
- -It does not check IPv6 addresses yet.
- -It does not scan ranges of ports or identify the program behind a port.
Defensive Use
A port that accepts connections from the internet exposes whatever program listens on it. TCP answers a connection attempt to a port with no listener with a reset, while a firewall that drops packets sends nothing back, so the three outcomes tell a forwarding problem apart from a filtering one. Checking from outside after each router or firewall change confirms which ports are actually reachable.
Frequently Asked Questions
What is a Port Checker?→
The port checker tries one TCP connection from the internet to your own IP address on the port you choose and reports what happened: the connection was accepted, it was refused, or nothing answered within 5 seconds. It checks only the address your request comes from, so it tests your own port forwarding and firewall rules and cannot be pointed at anyone else.
What is the Port Checker used for?→
Testing a port forwarding rule for a game server, a home lab or a remote desktop, and confirming that a port you closed on the router no longer accepts connections from the internet.
Is my data sent anywhere?→
The Port Checker sends your IP address and the port number you choose to ImmunitySec servers, which run the check and return the result. To run it, they contact only your own IP address, on the port you choose. Nothing else you enter leaves the page.
How is the Port Checker used defensively?→
A port that accepts connections from the internet exposes whatever program listens on it. TCP answers a connection attempt to a port with no listener with a reset, while a firewall that drops packets sends nothing back, so the three outcomes tell a forwarding problem apart from a filtering one. Checking from outside after each router or firewall change confirms which ports are actually reachable.
Why does my port show as closed when the program is running?→
A refused connection means a reset came back. Under RFC 9293 a host sends a reset when no program listens on the port, so the program may listen only on another address or port, or the router may forward the port to a different device than the one running the program.
Why is there no reply at all?→
Nothing answered within 5 seconds. A firewall may be dropping the connection, the router may have no forwarding rule, or your provider may use carrier-grade NAT, for which RFC 6598 reserves the 100.64.0.0/10 shared address space. If your router's WAN address is in that range, or differs from the address shown here, connections from the internet cannot reach your router.
Can I check port 25?→
No. Cloudflare Workers, which run this check, cannot open outbound connections on port 25.