# Port Checker: Is a Port Open from the Internet?

Check whether TCP ports are reachable from the internet. In self mode we connect back to the address the request came from (a port-forwarding test, up to 10 ports, any port); in public mode we check a few well-known ports (at most 3, such as 22, 25, 80, 443) on a public host, paced per server. Each port is open (a program answered), closed (the address answered and refused: reachable, nothing listening) or filtered (no answer in 4 seconds: a firewall, router or provider dropped it), with the round-trip time and the IANA service name. Adds hints when everything looks filtered: a shared (CGNAT) address, a provider blocking port 25. TCP connect only: no scanning, no UDP.

**Not for:** Scanning a network or a host for open ports, or checking UDP.

- Tool id: `port-check`
- Category: network
- Execution: network
- REST `GET https://lookupowl.com/api/v1/tools/port-check` (or POST a JSON body)
- OpenAPI: https://lookupowl.com/api/openapi.json

## Input

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `mode` | "self" \| "public" | no | `"self"` | self: connect back to the address this request came from (the port-forwarding test). public: check well-known ports on a public host. Only self can check any port. |
| `ports` | string | yes |  | One port from 1 to 65535, or a list separated by commas or spaces, up to 10 in self mode. In public mode only well-known ports (such as 22, 25, 53, 80, 443, 465, 587, 993, 995, 3306), at most 3. min length 1, max length 100 |
| `target` | string | no | `""` | public mode only: the host name or public IP address. Leave empty in self mode: the address is always the caller's own, never taken from input. max length 253 |
| `family` | "4" \| "6" \| "auto" | no | `"auto"` | self mode: which of your addresses to check when you have both IPv4 and IPv6. auto checks each one we can see. |

## Output

Results are wrapped in an envelope: `tool`, `version`, `requestId`, `data`, `summary`, `meta` (cache status, timing), `permalink`. `data` has these fields:

| Field | Type | Description |
|---|---|---|
| `mode` | "self" \| "public" |  |
| `target` | object |  |
| `ports` | object[] |  |
| `notChecked` | integer[] | public mode: ports that were asked for but are not on the well-known list, so no connection was made. |
| `hints` | object[] |  |
| `from` | object | Where the checks came from: our own server, and its address when we publish one. |

## Examples

### Is my web port open?

```json
{"mode":"self","ports":"443","target":"","family":"auto"}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/port-check?family=auto&mode=self&ports=443&target='
```

Web page: https://lookupowl.com/port-checker?q=443

### Minecraft and Plex on my connection

```json
{"mode":"self","ports":"25565, 32400","target":"","family":"auto"}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/port-check?family=auto&mode=self&ports=25565%2C+32400&target='
```

Web page: https://lookupowl.com/port-checker?q=25565%2C+32400

### HTTP and HTTPS on a public server

```json
{"mode":"public","ports":"80, 443","target":"example.com","family":"auto"}
```

```bash
curl 'https://lookupowl.com/api/v1/tools/port-check?family=auto&mode=public&ports=80%2C+443&target=example.com'
```

Web page: https://lookupowl.com/port-checker?q=80%2C+443&mode=public&target=example.com

## Web pages

- https://lookupowl.com/port-checker

## Limits and caching

- Cost: from 1 unit up, depending on the input (a registry lookup counts every upstream request); 1 unit for a cached result. Budgets are per network and published in the `RateLimit` response headers.
- Cache: results are never cached, per requester and never shared.
- Timeout: 20 s.

## Related tools

- [Ping from Many Places](https://lookupowl.com/tools/ping.md): Ping a host from our server or from probes in many countries: does it answer, how fast, and how much is lost.
- [Traceroute and MTR](https://lookupowl.com/tools/traceroute.md): Trace the path to a host from our server or other places, with the network behind each hop and a plain verdict.
- [What Is My IP Address](https://lookupowl.com/tools/what-is-my-ip.md): Show your public IP address, whether it is IPv4 or IPv6, its reverse DNS name and the network it belongs to.
- [Is It Down? Check a Website from Many Places](https://lookupowl.com/tools/http-check-global.md): Check a website from probes in many places: name lookup, connection, certificate and web server, with a plain verdict.
- [SSL Certificate Checker](https://lookupowl.com/tools/ssl-checker.md): Check a site's SSL/TLS certificate: days until it expires, whether it is trusted, matches the host and has a complete chain.

## Guide: Port checker

Find out whether a port on your connection is reachable from the internet, and what to try when it is not.

### What a port check tells you

A port is a numbered door on an address. Web servers listen on 443, SSH on 22, Minecraft usually on 25565. A port check knocks on one of those doors from the internet and reports what happened, which is the quickest way to learn whether port forwarding on your router really works.

The check is a single TCP connection attempt from our server. We send nothing once it connects, we do not read what the program says, and we never try UDP. A silent UDP port looks the same as a blocked one, so any tool that claims to test both with certainty is guessing.

> **By default we check your own address** In "My connection" mode we connect back to the address your request came from. You cannot point it anywhere else, so it cannot be used to knock on other people's doors.

### Open, closed and filtered

**Open** means the connection completed. The port is forwarded to a device and a program is listening, and we show how long the round trip took. Open is not the same as safe: if you did not mean to expose it, close it in your router or firewall.

**Closed** means your address answered and refused the connection. The road is open and the house is empty: nothing is listening on that port. Usually the program is not running, it listens only on your own computer, or the router forwards to a different device.

**Filtered** means we waited 4 seconds and heard nothing at all. Something in between swallowed the attempt: a router that does not forward the port, a firewall on the computer, or a provider that blocks the port or shares one address between many customers. Other tools call this "timed out", which hides the useful part.

### How to test a port-forwarding rule

1. **Start the program first**: Run the game server, Plex, the web server or whatever should answer. A port with nothing listening reports closed even when the router is right.
2. **Enter the port**: Type one port, or up to 10 separated by commas, such as `25565, 32400`. Ranges are not accepted on purpose: this is a check, not a scan.
3. **Read the answer**: One port gets a plain verdict. Several ports get a grid with the open ones first, and every cell opens to say what it means.
4. **Work through the checklist**: If any port is filtered, the page lists the usual causes in order: the program, the router forward, the computer firewall and finally your provider.

### When every port looks filtered

If you have checked the program, the forward and the firewall and nothing answers, the cause is usually before your router. Many providers, mobile networks and some fibre and satellite plans use carrier-grade NAT (CGNAT): one public address shared between many customers. No port forward on your side can work through it.

A quick test: look at the WAN or internet address on your router's status page and compare it with the address we show. If they differ, or the router shows a number starting 100.64 to 100.127, you are behind CGNAT. Your provider can usually give you a public address, often for a small fee, or you can use a tunnel or a relay service instead. The [what is my IP](https://lookupowl.com/what-is-my-ip) page shows the address the internet sees.

> **Port 25 is a special case** Many providers block port 25 on home connections to stop spam. If only port 25 is filtered, it is usually not your router. Ask the provider, or send mail through port 587 with a mail service.

### Checking a server that is not yours

Choose "A public server" to check a short list of well-known ports (such as 22, 25, 53, 80, 443, 465, 587, 993, 995 and 3306) on a host name or public address. To keep other people's servers safe, that mode takes at most 3 ports, no ranges, connects once from one address, paces how often one server is asked and refuses private, reserved and local addresses.

It is not a scanner, and it cannot be one. To test any other port, run the check from the network the port is on with "My connection". If you run a server and prefer not to be checked, write to talk@lookupowl.com with the address and we will add it to the list.

### Frequently asked questions

**Why does every port look filtered?**

Often your provider shares one public address between many customers (CGNAT), or blocks the port. Check that before changing your router. A computer firewall that blocks new ports shows up the same way.

**What is the difference between closed and filtered?**

Closed means your address answered and refused, so the connection can get there and nothing is listening. Filtered means no answer at all within 4 seconds, so something in between dropped it. They need different fixes.

**Does open mean my port is safe?**

No. Open only means a program accepted the connection from the internet. If you did not mean to expose that service, close the forward in your router or block the port in your firewall.

**Can I check UDP ports?**

No. A UDP port that stays silent cannot be told apart from a blocked one, so we only test TCP and say so. Game servers that use UDP often also open a TCP port you can test.

**Why can I only check certain ports on other servers?**

To keep other people's servers safe. Port checks are easy to misuse as a scanner, so other servers get a short list of well-known ports, three at a time, and paced per server. Your own connection has no such limit beyond 10 ports.

**Does it work with IPv6?**

Yes, when your request reaches us over IPv6 we check your IPv6 address. IPv6 has no NAT, so a port often works without forwarding, but a firewall rule is still needed. We only see the address your request arrived from.

**Why does the address we show differ from my router's?**

The router shows the address your provider gave it. We show the address the internet sees. If they differ, your provider is translating addresses, which means CGNAT, or you are using a VPN or proxy.

**Is my address stored?**

Checks on your own connection are not added to any audit list. For other servers we keep the host and ports in a short audit log so an abuse report can be followed up.