NetKit

Open port checker

Check whether a TCP port on your server or home connection is reachable from the internet. Use it to confirm port forwarding, firewall rules and cloud security groups.

Port check

Checks run from NetKit's server (Vercel), i.e. from the public internet towards your host.

Port forwarding checklist

  1. Find the device's local IP (e.g. 192.168.1.50) and give it a DHCP reservation so it doesn't change.
  2. Make the service listen on all interfaces (0.0.0.0 or ::), and confirm locally: ss -tlnp (Linux), netstat -ano | findstr LISTEN (Windows).
  3. Allow the port in the device's firewall.
  4. On the router, forward external TCP port → 192.168.1.50 : internal port.
  5. Check your router's WAN address matches the IP on what is my IP. If the WAN IP is private or 100.64.x.x, you're behind CGNAT; ask the ISP for a public IP, or use a tunnel (Cloudflare Tunnel, Tailscale Funnel).
  6. Test here. Testing from inside your own network often fails even when forwarding works, because many routers don't support NAT loopback.

Questions people ask

How does an open port checker work?
Our server tries to open a TCP connection to the host and port. If the target completes the handshake, the port is open (something is listening and reachable). If it replies with a reset, it is closed. If nothing answers within 2.5 seconds, a firewall is silently dropping the packets: filtered.
My port shows closed but my app is running. Why?
The usual causes, in order: the app listens on 127.0.0.1 only instead of 0.0.0.0; a host firewall (Windows Defender, ufw, firewalld) blocks it; the router has no port-forward to the right internal IP; your ISP uses carrier-grade NAT (your router's WAN IP starts with 100.64–100.127), which makes inbound connections impossible without a tunnel.
Can I check UDP ports?
No. UDP has no handshake, so an external check can't tell "open" from "filtered" without a service-specific probe. Test UDP services (game servers, WireGuard, DNS) with their own client.
Is it legal to check ports?
Checking your own servers is routine. Scanning systems you don't own may breach your provider's acceptable-use policy or local law. NetKit limits the rate and only accepts public addresses.
Which port numbers are which?
Common ones: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3389 RDP, 3306 MySQL, 5432 PostgreSQL, 25565 Minecraft, 32400 Plex, 51820 WireGuard (UDP). The port scanner checks 22 common services at once.