How this port checker works
Your browser cannot test its own ports from the outside — it sits behind the very router you are trying to check. So when you press Check port, our small edge function (/api/port, running on Cloudflare) opens a real TCP connection to the public address your request came from, on the port you chose, exactly as a friend joining your server would. It never accepts a different target: the address comes from the connection itself, so the tool can only ever test you, and it cannot be turned into a scanner for somebody else’s network. Nothing is logged or stored, and checks are rate-limited so a mistyped range cannot hammer your router.
Your public address is shown at the top. If it is an IPv4 address, that is the one your router presents to the whole internet; if the page says IPv6, read the note there, because IPv6 has no NAT and ordinary port-forwarding rules do not apply to it. Use what is my IP address to see both your IPv4 and IPv6 addresses side by side.
Open, closed and no response: what each result means
TCP connections start with a handshake, and the three ways that handshake can end tell you different things:
| Result | What happened | Usual cause |
|---|---|---|
| Open | Something accepted the connection. | The forward works and a program is listening. On ports 80, 443 and 8080 make sure it is your server and not the router’s own admin page. |
| Closed | The connection was actively refused (a TCP reset). | No forwarding rule, a forward to the wrong device, or the program is not running. The refusal can come from your router, the device or occasionally your provider — we can’t see which. |
| No response | Nothing came back within five seconds. | A firewall silently dropped it (Windows Defender Firewall does this by default), the forward points at an IP with no device, carrier-grade NAT, or the provider filters the port. |
Two honest limits. First, UDP cannot be tested by this or any web-based checker: UDP has no handshake, so silence means either “open and waiting” or “blocked”, and only the game’s own protocol can tell them apart. Minecraft Bedrock (19132), Valheim, Palworld, WireGuard and most console NAT-type traffic are UDP; the presets mark them clearly. Second, port 25 cannot be tested: our edge network forbids outgoing connections to it, and nearly every UK provider blocks it on home lines anyway.
CGNAT, double NAT and other reasons a forward never works
If the port stays closed however carefully you set it up, check whether your router actually owns a public address. Open the router’s status page and find its WAN or internet IP, then paste it into the comparison box. Three outcomes are possible:
- It matches the address shown at the top — no CGNAT. The problem is the forward, the device’s firewall or the program.
- It starts with 100.64 to 100.127 — carrier-grade NAT (RFC 6598). Your provider shares one public IPv4 address between many homes, so no rule on your router can ever let traffic in. This is normal on 4G and 5G home broadband and used by several full-fibre providers. Ask for a public or static IPv4 address, use IPv6 if available, or use a tunnel such as Tailscale or playit.gg.
- It is a private address (192.168.x.x, 10.x.x.x or 172.16–31.x.x) — double NAT. Your router is plugged into another router, typically the provider’s hub. Put the hub into modem or bridge mode, or forward the port on both boxes.
A WAN address that is public but different from the one shown here usually means a VPN or proxy is active — turn it off and refresh.
Fixing a closed port, step by step
- Confirm the program is listening on the device:
netstat -ano | findstr :25565on Windows should showLISTENINGon0.0.0.0, not only127.0.0.1. - Give the device a fixed LAN address with a DHCP reservation, then forward external port → that IP and internal port, protocol TCP (or both).
- Allow it through the firewall. Windows asks the first time a server starts — allow it on Private networks and make sure your home network is marked Private. The PowerShell command in the tool adds a rule by hand.
- Test from outside. Checking your public address from a PC on the same Wi-Fi fails on routers without NAT loopback, so trust this page (or a phone on mobile data) rather than a local test.
- Try a different external port if a common one stays filtered: some providers filter 80, 443 or 445 inbound on residential lines.
Security matters once a port is open. Never expose databases, Windows file sharing (445) or VNC; put Remote Desktop behind a VPN; keep camera recorders and NAS firmware updated. Running a website at home? After opening 80 and 443, the SSL certificate checker and the HTTP headers checker confirm HTTPS and redirects are set up properly.
Frequently asked questions
Is this port checker safe and legal to use?
Yes. It only ever connects to the public address your own request came from, so you can test your own network but nobody else’s — the target cannot be changed. Each check is a single ordinary connection attempt, exactly what a friend joining your game server would make. Nothing is logged or stored, and checks are rate-limited.
Why does my port show as closed when the server is running?
The most common reasons are a forward pointing at the wrong internal IP (the device’s address changed after a reboot), Windows Firewall blocking the program, the server bound to 127.0.0.1 only, or your provider using carrier-grade NAT. Work through the five troubleshooting steps and compare your router’s WAN address — together they pinpoint the cause in almost every case.
Can you check UDP ports like Minecraft Bedrock 19132?
No, and no honest web tool can. UDP has no handshake, so an open UDP port and a blocked one both usually return silence; only the application’s own protocol can prove it works. Forward the UDP port, start the server, and ask someone on another connection — or use your phone on mobile data — to join. The presets flag every UDP-only service.
What is the difference between closed and no response?
Closed means something actively refused the connection with a TCP reset — typically your router has no rule for that port, or the device has no program listening. No response means the attempt was silently dropped: a firewall, a forward to a device that doesn’t exist, carrier-grade NAT or provider filtering. Dropping is what Windows Defender Firewall does by default.
Why does it test IPv6 instead of my IPv4 address?
We test whichever address your browser used to reach us, and most dual-stack connections prefer IPv6. IPv6 has no NAT, so your router’s port-forwarding rules don’t apply — its IPv6 firewall must allow the port instead. To test IPv4, temporarily switch off IPv6 on this device as described at the top of the tool, then refresh the page.
Does it work with a VPN, WARP or iCloud Private Relay?
It tests the address the internet sees, which with a VPN is the VPN server’s, not your router’s — so results will describe the VPN. Cloudflare WARP and some iCloud Private Relay exits are on Cloudflare’s own network, which our server is not allowed to connect back into; the tool detects this and asks you to switch it off rather than reporting false results.