Skip to content
LookupOwl

Port checker

Find out whether a port on your connection is reachable from the internet, and what to try when it is not.

A number from 1 to 65535, or a short list: up to 10 ports on your connection, at most 3 well-known ports on a public server.

My connection checks your own address. A public server is checked on well-known ports only.

More options

Only used when you check a public server.

self mode: which of your addresses to check when you have both IPv4 and IPv6. auto checks each one we can see.

Try:

Your IP address

Checked live lookup4004 ms

JSON

No answer

No answer on port 443

We waited 4 seconds and heard nothing. In order of likelihood: the router does not forward it, a firewall on the computer blocks it, or your provider blocks or shares the address.

FilteredCommonly used for secure websites
Your address as we see it
216.73.217.134

Amazon.com, Inc., AS16509. Looks like a hosting or cloud network.

What the answer means
  • OpenWe knock and a program answers. The port is forwarded and something is listening.
  • ClosedWe knock and your address says "nobody here". The road is open, the house is empty.
  • No answer (filtered): your resultWe knock and hear nothing. Something in between, a router, firewall or your provider, swallowed it.

Your result is highlighted: filtered, no answer.

  • The address we see is 216.73.217.134, which looks like a VPN or hosting address (AS16509). If you use a VPN, this checks the VPN’s address, not your router’s.
  • We didn't see an IPv6 address for your connection, so we only checked IPv4.
Why does it say no answer?

Guide, not a result

Note1. Is the program running and listening?

Start the server, then check it listens on all addresses (0.0.0.0), not only 127.0.0.1.

Note2. Is the router forwarding the port to this device?

The forward must point at this computer's local address, and that address must not have changed.

Note3. Is your own firewall allowing it?

Windows Defender, macOS and most Linux firewalls block new ports until you allow them.

Note4. Does your provider give you your own public address?

If your provider shares one address between many customers (CGNAT), no port forward can work. Compare the address on your router's status page with the one we see: if they differ, or it starts 100.64 to 100.127, the address is shared.

Check again

Structured result (JSON) · 953 B
{
  "mode": "self",
  "target": {
    "ip": "216.73.217.134",
    "family": 4,
    "kind": "hosting",
    "network": {
      "asn": 16509,
      "name": "Amazon.com, Inc."
    }
  },
  "ports": [
    {
      "port": 443,
      "state": "filtered",
      "rttMs": null,
      "service": "https",
      "label": "commonly used for secure websites",
      "note": "No answer within 4 s. See the checklist below."
    }
  ],
  "notChecked": [],
  "hints": [
    {
      "code": "ALL_FILTERED",
      "text": "We heard nothing back on this port."
    },
    {
      "code": "VPN_OR_HOSTING",
      "text": "This address looks like a VPN or hosting address. If you use a VPN, this checks the VPN, not your router."
    },
    {
      "code": "NO_IPV6",
      "text": "We didn't see an IPv6 address for your connection, so we only checked IPv4."
    }
  ],
  "from": {
    "note": "Checked from our server, with one connection per port and nothing sent."
  }
}

Next step

What a port check tells you

A port is a numbered door on an address. Web servers listen on 443, SSH on 22, Minecraft usually on 25565. A port check knocks on one of those doors from the internet and reports what happened, which is the quickest way to learn whether port forwarding on your router really works.

The check is a single TCP connection attempt from our server. We send nothing once it connects, we do not read what the program says, and we never try UDP. A silent UDP port looks the same as a blocked one, so any tool that claims to test both with certainty is guessing.

Open, closed and filtered

Open means the connection completed. The port is forwarded to a device and a program is listening, and we show how long the round trip took. Open is not the same as safe: if you did not mean to expose it, close it in your router or firewall.

Closed means your address answered and refused the connection. The road is open and the house is empty: nothing is listening on that port. Usually the program is not running, it listens only on your own computer, or the router forwards to a different device.

Filtered means we waited 4 seconds and heard nothing at all. Something in between swallowed the attempt: a router that does not forward the port, a firewall on the computer, or a provider that blocks the port or shares one address between many customers. Other tools call this "timed out", which hides the useful part.

How to test a port-forwarding rule

  1. Start the program firstRun the game server, Plex, the web server or whatever should answer. A port with nothing listening reports closed even when the router is right.
  2. Enter the portType one port, or up to 10 separated by commas, such as 25565, 32400. Ranges are not accepted on purpose: this is a check, not a scan.
  3. Read the answerOne port gets a plain verdict. Several ports get a grid with the open ones first, and every cell opens to say what it means.
  4. Work through the checklistIf any port is filtered, the page lists the usual causes in order: the program, the router forward, the computer firewall and finally your provider.

When every port looks filtered

If you have checked the program, the forward and the firewall and nothing answers, the cause is usually before your router. Many providers, mobile networks and some fibre and satellite plans use carrier-grade NAT (CGNAT): one public address shared between many customers. No port forward on your side can work through it.

A quick test: look at the WAN or internet address on your router's status page and compare it with the address we show. If they differ, or the router shows a number starting 100.64 to 100.127, you are behind CGNAT. Your provider can usually give you a public address, often for a small fee, or you can use a tunnel or a relay service instead. The what is my IP page shows the address the internet sees.

Checking a server that is not yours

Choose "A public server" to check a short list of well-known ports (such as 22, 25, 53, 80, 443, 465, 587, 993, 995 and 3306) on a host name or public address. To keep other people's servers safe, that mode takes at most 3 ports, no ranges, connects once from one address, paces how often one server is asked and refuses private, reserved and local addresses.

It is not a scanner, and it cannot be one. To test any other port, run the check from the network the port is on with "My connection". If you run a server and prefer not to be checked, write to [email protected] with the address and we will add it to the list.

Questions people ask

Why does every port look filtered?

Often your provider shares one public address between many customers (CGNAT), or blocks the port. Check that before changing your router. A computer firewall that blocks new ports shows up the same way.

What is the difference between closed and filtered?

Closed means your address answered and refused, so the connection can get there and nothing is listening. Filtered means no answer at all within 4 seconds, so something in between dropped it. They need different fixes.

Does open mean my port is safe?

No. Open only means a program accepted the connection from the internet. If you did not mean to expose that service, close the forward in your router or block the port in your firewall.

Can I check UDP ports?

No. A UDP port that stays silent cannot be told apart from a blocked one, so we only test TCP and say so. Game servers that use UDP often also open a TCP port you can test.

Why can I only check certain ports on other servers?

To keep other people's servers safe. Port checks are easy to misuse as a scanner, so other servers get a short list of well-known ports, three at a time, and paced per server. Your own connection has no such limit beyond 10 ports.

Does it work with IPv6?

Yes, when your request reaches us over IPv6 we check your IPv6 address. IPv6 has no NAT, so a port often works without forwarding, but a firewall rule is still needed. We only see the address your request arrived from.

Why does the address we show differ from my router's?

The router shows the address your provider gave it. We show the address the internet sees. If they differ, your provider is translating addresses, which means CGNAT, or you are using a VPN or proxy.

Is my address stored?

Checks on your own connection are not added to any audit list. For other servers we keep the host and ports in a short audit log so an abuse report can be followed up.

Use it from AI, the API or the command line

Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is port_check. Please be kind to the rate limits.

curl
curl "https://lookupowl.com/api/v1/tools/port-check?q=443"

Description for AI agents · OpenAPI · llms.txt