TCP Port Checker
Check whether your IP accepts a TCP connection from outside. Troubleshoot access to a NAS, home server, or game server.
We check this IP’s port
from outside your network.
- Shared requests used
- —
- Checks remaining
- —
- TCP connection timeout
- 3 s
Request allowance resets in —
Checking the allowance for this IP.
Loading usage…
How usage is counted
The default is 30 network-tool requests per public IP per hour. An administrator may temporarily change or waive it; the current allowance is shown above. Accepted requests count even if they fail.
The allowance resets one hour after the first request. Remaining checks are the smaller of the request allowance and target protection allowance. Shared server limits may also require a short wait.
The timeout is the wait for a TCP connection. Total response time, including server processing and network communication, may be longer.
Common ports
No sign-in · Your IP only · Ports 1–65535
How do I find my port number?
An IP address alone does not tell you a service’s port. Check the connection settings in your NAS or server application. HTTP commonly uses 80 and HTTPS 443, but your actual configuration takes precedence. If your router forwards external port 8080 to internal port 80, enter 8080 here. PPORT checks one TCP port you enter; it does not automatically scan all ports or open them for you.
Check listening ports on your device
Whatever the test result, run these commands on the PC or server running the service. They only read its status.
The commands follow the port entered above. If the router maps a different internal port, replace the command’s port number with that internal port.
How to check
- Copy and run the command for your operating system below.
- On Windows, the last column is PID or OwningProcess. On Linux look for pid=; on macOS use the PID column.
- In Windows CMD, put the PID in place of 1234 in the tasklist command to find the program name.
Windows · PowerShell
Get-NetTCPConnection -State Listen | Where-Object LocalPort -EQ 80 | Select-Object LocalAddress,LocalPort,OwningProcessWindows · CMD
netstat -ano | findstr "LISTENING" | findstr /C:":80 "tasklist /FI "PID eq 1234"Linux · Terminal
sudo ss -ltnp 'sport = :80'macOS · Terminal
sudo lsof -nP -a -iTCP:80 -sTCP:LISTENHow to read the output
- LISTEN or Listen means a program is waiting for TCP connections. PID or OwningProcess identifies its process.
- 127.0.0.1 or ::1 accepts connections only from the same device.
- 0.0.0.0 means all IPv4 interfaces; :: means all IPv6 interfaces. Whether :: also accepts IPv4 depends on the OS and program settings.
- No output means no listening socket is visible for that port. Check the running program, port and permissions. On Windows, retry in administrator PowerShell.
- LISTEN does not guarantee external access. Check the firewall, port forwarding and public IP. For containers, WSL or virtual machines, also check internal listeners and host port publishing.
Next check Try the actual service URL. For websites, continue with the HTTP/certificate tools and the OPEN case below.
Diagnosis for this result
A TCP connection from PPORT to this IP and port succeeded. This does not verify HTTP/HTTPS responses, login or security.
Possible causes
Another program, router or proxy may accept the connection. Application failure can involve the protocol, TLS or backend.
Check in this order
- Use the OS commands below to inspect LISTEN, the binding address and PID. No output means checking the application, port and viewing permissions first.
- Connect using the correct protocol and domain; inspect HTTP status, certificates, proxy and application logs.
Related guides and tools
Next check Start with the internal port, LISTEN address and PID on the service host.
Diagnosis for this result
The TCP connection attempt was refused. This test cannot identify which device or point in the path refused it.
Possible causes
There may be no listener, forwarding may use the wrong internal port, or a device on the path may explicitly reject connections.
Check in this order
- On the service host, check that the application is running and identify its internal TCP port.
- Use the OS commands below to inspect LISTEN, the binding address and PID. No output means checking the application, port and viewing permissions first.
- From another LAN device, connect to the private server IP and internal port. If that fails, check binding, the host firewall and the LAN path first.
- Inspect the active firewall profile, allowed port, source scope and block logs. Do not switch off the entire firewall.
- Check that the router maps the external TCP port to the current internal server IP and port.
- Record one verified change, time, IP and port, then repeat the external test once within your allowance. Do not run automatic retries.
Related guides and tools
Next check Narrow it down: application → LISTEN → LAN → firewall → forwarding → upstream NAT → external retest.
Diagnosis for this result
The connection did not complete within the displayed TCP timeout. This does not identify a particular firewall or router as the cause.
Possible causes
Packet drops, an offline host, incorrect routing/forwarding, NAT or a temporary connection problem are all possible.
Check in this order
- On the service host, check that the application is running and identify its internal TCP port.
- Use the OS commands below to inspect LISTEN, the binding address and PID. No output means checking the application, port and viewing permissions first.
- From another LAN device, connect to the private server IP and internal port. If that fails, check binding, the host firewall and the LAN path first.
- Inspect the active firewall profile, allowed port, source scope and block logs. Do not switch off the entire firewall.
- Check that the router maps the external TCP port to the current internal server IP and port.
- Compare the router WAN IP with the displayed public IP; check upstream routers and provider NAT. Treat IPv4 and IPv6 separately.
- Record one verified change, time, IP and port, then repeat the external test once within your allowance. Do not run automatic retries.
Related guides and tools
Next check Check the target IP, IP version and internet connection, then compare local connectivity and the upstream path.
Diagnosis for this result
The connection attempt returned a host or network unreachable error. It does not locate the failing segment.
Possible causes
Routing on either side, connection failure, an address change or an intermediate device response may be involved. This is not proof of CGNAT.
Check in this order
- Check the displayed target IP, internet connection and VPN. If the error persists after a later retry, send the time and result to the operator, without passwords or tokens.
- Use the OS commands below to inspect LISTEN, the binding address and PID. No output means checking the application, port and viewing permissions first.
- From another LAN device, connect to the private server IP and internal port. If that fails, check binding, the host firewall and the LAN path first.
- Compare the router WAN IP with the displayed public IP; check upstream routers and provider NAT. Treat IPv4 and IPv6 separately.
- Record one verified change, time, IP and port, then repeat the external test once within your allowance. Do not run automatic retries.
Related guides and tools
Next check The result is inconclusive. Check local listening, then retry once later.
Diagnosis for this result
An unclassified connection error prevented a determination of open or closed.
Possible causes
A temporary issue in the PPORT runtime or network may be involved. Do not use this result as evidence of a blocked port.
Check in this order
- Check the displayed target IP, internet connection and VPN. If the error persists after a later retry, send the time and result to the operator, without passwords or tokens.
- Use the OS commands below to inspect LISTEN, the binding address and PID. No output means checking the application, port and viewing permissions first.
- Record one verified change, time, IP and port, then repeat the external test once within your allowance. Do not run automatic retries.
Related guides and tools
Quick start
- Check the IP shown above.
- Enter a port or choose a common port.
- Follow the next check for your result.
Read your result
| Result | What it means | Check next |
|---|---|---|
| OPEN | A TCP connection to this IP and port succeeded. | Check the actual web, game, or NAS application. |
| CLOSED | The TCP connection was refused. | Check the listening application and firewall reject rules. |
| TIMEOUT | The connection did not complete within 3 seconds. | Check the firewall, forwarding rule, power, and connectivity. |
| UNREACHABLE | The connection reported a host or network unreachable error. | Check the network route and connection. |
| ERROR | Another connection error occurred. | Try again; report the time and port if it persists. |
When the connection fails
- Make sure the server application is running on the PC or NAS.
- Check its listening address and TCP port. A service bound only to 127.0.0.1 accepts local connections; use the intended LAN address or interface for external access.
- Allow the required TCP port and source addresses in the device firewall.
- For IPv4 behind a router, map the external port to the device’s LAN IP and internal port.
- Compare the router’s WAN IPv4 with the public IPv4 shown here. A difference can indicate upstream NAT, another router, or a VPN.
Check the listening port on your server
Run these commands on the device hosting the service. Replace 8080 with your port. Binding to a specific LAN address can work; 0.0.0.0 is not mandatory.
ss -ltn 'sport = :8080'Get-NetTCPConnection -LocalPort 8080 -State ListenExample forwarding rule
If a NAS at 192.168.1.20 listens on TCP 5000, an example rule is external TCP 5000 → 192.168.1.20:5000. Reserve the device’s LAN address so that it does not change.
The external and internal ports may differ. Test the external port here. IPv6 commonly uses routing and firewall rules rather than IPv4-style port forwarding.
What this tool checks
This tool checks one TCP port, from 1 through 65535, on the IP of your current connection. It does not accept another target IP, scan every port, or test UDP.
A VPN may expose its exit IP. The displayed IP is the address used by this connection, not a list of every IPv4 and IPv6 address your device has. A NAT result concerns the translated external path, not necessarily this PC alone.
This is a point-in-time check from the PPORT server. Application data is not sent. Request limits apply.