How to use it
- Check Your public IP at the top: that's the only address the test can reach.
- Type a number in Port number, or choose one under Common ports.
- Make sure the program or device that should answer is running, then press Check.
- Read the result. If the port is closed, work through the tips under it and press Check again.
What the test does
Our server on Cloudflare tries to open one TCP connection to the address your request came from, on the port you chose. If the connection is accepted within 5 seconds, the port is open; nothing else is sent. It never tests any other address, and nothing is stored.
It can't test everything:
- Only TCP. Services that use UDP, as many game servers and voice apps do, can't be checked this way.
- Not port 25. Cloudflare's documentation states that Workers can't open outbound connections on port 25, the port mail servers use.
- Not Cloudflare's own addresses. Outbound connections to Cloudflare IP ranges are blocked, so the test can't reach you while you're connected through Cloudflare's WARP app.
Reading the result
| Result | Usual cause |
|---|---|
| Port open | Something answers. Often your program, but the router itself can also answer, for example its admin page on 80, 443 or 8080. |
| No answer within 5 seconds | A firewall silently drops the connection, or the router has no forwarding rule for this port. |
| Refused | The connection reached a device, but nothing listens on that port or a firewall rejects it. |
Opening a port: port forwarding
Behind a home router, devices share one public IPv4 address. Plex's guide lists what a forwarding rule needs, and the same steps work for any service:
- Give the device a fixed local address, for example with a DHCP reservation in the router.
- Add a rule: external port, internal port and the device's local address, protocol TCP. For a Minecraft server on
192.168.1.20: TCP 25565 to 192.168.1.20 port 25565. - Allow the port in the device's own firewall.
If your connection uses IPv6, the test reaches your IPv6 address. Devices then usually have their own public address, so instead of forwarding you allow the port in the router's IPv6 firewall.
Double NAT and CGNAT
Compare the WAN or internet address on your router's status page with Your public IP here. If they differ, something else does address translation in front of your router: a second router (double NAT) or your ISP. Carrier-grade NAT uses the shared range 100.64.0.0/10 (100.64.0.0 to 100.127.255.255) set aside by RFC 6598. Behind it, no forwarding rule on your router can help. Plex suggests putting one router in bridge mode for double NAT, and asking the ISP for a public IP address for CGNAT.
Questions
- Why can't I test port 25?
- Cloudflare Workers, which run this site's server code, are not allowed to open outbound connections on port 25.
- Can I check a port on another address, such as my server?
- No. The test only reaches the address you're connecting from, so it can't be used to scan anyone else. To check a server, open this page from a device on that server's network.
- My port is forwarded but still shows closed. What now?
- Check that the program is running, that the rule points to the device's current local address, and the device's firewall. Then compare your router's WAN address with your public IP to rule out double NAT or CGNAT. Some ISPs also block certain ports.
- Does an open port mean I've been hacked?
- No. It means a device on your network accepts connections on it. Keep only the ports you need open, and keep that device's software updated.
- Is the test done over IPv4 or IPv6?
- Over the address your browser used to reach this site, shown under Your public IP. Find both of your addresses on /what-is-my-ip.