Inbound Open Port & Firewall Checker
Test whether your home router, VPS, or cloud instance is exposing open services to the public internet. Probes standard ports for web, mail, SSH, and databases using non-blocking TCP socket verification.
Reserved banner container configured with strict Core Web Vitals CLS = 0 layout preservation.
Understanding Port States: Open vs. Closed vs. Filtered (Stealth)
When an external client attempts to initiate a TCP connection with a remote IP address, the network layer executes a standard three-way handshake (SYN → SYN-ACK → ACK). How your operating system or network perimeter firewall reacts to the initial SYN packet determines the diagnostic state of that port:
The target host received the TCP SYN packet and an active application daemon (such as Nginx, OpenSSH, or MySQL) replied with a TCP SYN-ACK packet. The port is reachable by any host on the public internet.
The target server received the packet, but no daemon was listening on that port. The kernel immediately replied with a TCP RST (Reset) packet (ECONNREFUSED). The machine is online, but the service is down.
The client packet never elicited any response. A stateful firewall (iptables, UFW, AWS Security Group, or router NAT) silently dropped the packet into a black hole. The probe timed out after 2,500ms without receiving a RST or SYN-ACK.
The Security Catastrophe of Exposing Database & Admin Ports (3306, 5432, 6379, 3389)
Exposing core relational databases (MySQL, PostgreSQL) or in-memory caches (Redis) to the public internet (0.0.0.0) is one of the most common causes of data exfiltration and ransomware attacks. Automated botnets continuously scour IPv4 address ranges scanning ports 3306, 5432, 6379, and 27017 for default passwords, unpatched remote code execution (RCE) flaws, or unauthenticated instances:
Port 3306 (MySQL) & 5432 (Postgres)
Database protocols were never engineered to face untrusted public traffic. Exposing them invites relentless dictionary attacks against root and opens the door to SSL protocol vulnerabilities. Always bind to 127.0.0.1 or require an SSH tunnel or WireGuard VPN.
Port 6379 (Redis In-Memory Store)
Redis is intentionally designed for ultra-low latency within secure internal networks. An exposed Redis instance without requirepass allows remote attackers to dump all database keys, overwrite cron jobs, or drop SSH authorized keys directly onto the server host filesystem.
Standard Port Directory & Threat Assessment Reference
| Port | Protocol | Service | Typical Use Case | Public Internet Policy |
|---|---|---|---|---|
| 21 | TCP | FTP | File Transfer Protocol (Cleartext) | Block immediately. Replace with SFTP (Port 22). |
| 22 | TCP | SSH / SFTP | Encrypted secure shell access | Allow only from VPN/Static IP; disable password login. |
| 25 | TCP | SMTP Relay | MTA-to-MTA email routing | Only open if operating a dedicated inbound MX server. |
| 80 | TCP | HTTP | Standard web traffic / ACME challenges | Safe to expose (redirect 100% to HTTPS). |
| 443 | TCP/UDP | HTTPS / HTTP/3 | Encrypted TLS web browsing and APIs | Standard internet entry point. Keep web server updated. |
| 3306 | TCP | MySQL / MariaDB | Relational database storage | Never expose to 0.0.0.0. Bind to 127.0.0.1. |
| 3389 | TCP/UDP | RDP | Windows Remote Desktop | Critical vulnerability. Restrict behind WireGuard or Tailscale. |
| 5432 | TCP | PostgreSQL | Enterprise relational database | Never expose directly. Restrict to internal application VPC subnet. |
Frequently Asked Questions (FAQ)
Why does this tool show "Filtered" instead of "Closed"?
A closed port means your server received our TCP SYN packet and actively sent back a TCP RST packet. A "Filtered" status means an intermediate firewall (such as your broadband router, cloud security group, or UFW) dropped the packet without sending any reply, causing the connection to time out.
Can this tool test ports inside my local home LAN?
No. This scanner initiates inbound connections from our public cloud servers back to your public IP. It tests what external internet users can see. If you run a service on 192.168.1.50:80, it will only appear open if you have configured Port Forwarding on your router.
Why is Port 25 blocked on residential internet?
Virtually all consumer ISPs (Comcast, Verizon, AT&T, Spectrum) block outbound and inbound Port 25 by default to prevent compromised malware-infected computers from sending massive volumes of spam. Legitimate email clients should use Port 587 (Submission) or Port 465 (SMTPS).
How can I quickly close an open port on Linux?
Use our companion Linux Firewall Rule Generator to create clean UFW or iptables rules. For example, running sudo ufw deny 3306 immediately drops inbound connections to MySQL.