Port Checker

This tool tries to open a TCP connection to one port, from Cloudflare's network — outside your own network — and reports what happened. It completes the handshake and closes the connection straight away; nothing is sent or read.

Open means something accepted the connection: a service is listening and reachable. Closed means the host answered but refused (a TCP reset) — it's reachable, but nothing is listening on that port, or a firewall is actively rejecting it. Filtered means no answer at all within 5 seconds: a firewall is silently dropping the connection, or the host is offline. Filtered is what most home routers and cloud firewalls do by default.

Only TCP can be checked. UDP has no handshake — a UDP packet to an open port usually gets no reply, exactly like one that was dropped, so there's no reliable way to tell them apart from outside. Game consoles and VoIP often use UDP ports too; a TCP check only covers the TCP side.

Port forwarding tells your router to pass connections arriving on a public port to one device on your network. To host something at home (a game server, a camera, remote desktop), you need a forwarding rule on the router, the service running on the device, and the device's firewall allowing it. Leave the host empty here to test your own public IP from the outside. If your connection uses IPv6, your IPv6 address is tested, and IPv6 needs a firewall rule on the router rather than port forwarding.

CGNAT (carrier-grade NAT) means your ISP shares one public IP between many customers, so your router never gets a public address and nothing from the internet can reach you — port forwarding can't fix it. It's common on mobile, satellite, fixed-wireless and some fiber providers. The tell: your router's WAN IP differs from your public IP, or falls in 100.64.0.0/10.

Limits: one port per check, five checks per minute per network, and only public addresses. Cloudflare doesn't allow these connections on port 25 (email) or to Cloudflare's own IP addresses, so sites behind Cloudflare's proxy show as "can't test". To check a website itself, use the Down Checker.