How to check whether a port is open (e.g. after port forwarding on a router)
Open, closed and filtered ports, router port forwarding, firewalls and CGNAT, the most common reasons why "nothing works".
You run a game server, a camera, Home Assistant or a VPN at home and want to reach it from outside. You set up port forwarding on the router, yet from your phone on mobile data there is still nothing. To find the cause you need to test the port from the Internet, not from your own network. This article explains how to do it and how to read the result.
Open, closed, filtered
A TCP port test is an attempt to open a connection. There are three possible answers:
| Result | What happened | What it usually means |
|---|---|---|
| open | something accepted the connection | the service is running and reachable from outside |
| closed | a refusal came back (RST) | the packet reached the device, but nothing listens on that port |
| filtered | no answer at all | a firewall on the way silently drops packets, or there is no forwarding |
“Closed” is, paradoxically, good diagnostic news: traffic gets through and the problem is in the service itself. “Filtered” tells you to look for a firewall or a missing forwarding rule.
Step by step: where traffic can stop
A packet from the Internet passes through several places and can get stuck in any of them:
- The service must listen on the right port and the right address. A program listening only on
127.0.0.1is unreachable even from the local network. On Linux check withss -tlnp, on Windows withnetstat -ano. - The system firewall (Windows Defender,
ufw,firewalld) must allow incoming traffic on that port. - Port forwarding on the router (NAT, “virtual server”): external port → the device’s local address and port. The device should have a fixed local address (DHCP reservation), otherwise after a restart the rule points at nothing.
- The ISP must give you a public IP address. This is where the most common cause hides, described below.
CGNAT: when forwarding cannot work
Many ISPs, especially mobile, fibre and small local providers, do not give customers a public IPv4 address. Your router gets a private address, and the public one is shared by many customers on the ISP’s equipment (CGNAT, carrier-grade NAT). Forwarding on your router does nothing then, because traffic from the Internet does not know which customer to reach.
How to recognise it: compare the WAN address in the router’s admin panel with the address shown by What is my IP. If they differ, or the WAN address starts with 100.64.–100.127., 10., 172.16.–172.31. or 192.168., you are behind the ISP’s NAT. One exception: a 192.168. address can also mean there is a second router in front of yours (e.g. the ISP’s modem in router mode). Then forwarding has to be set on both, or the modem switched to bridge mode.
What you can do:
- ask the ISP for a public IPv4 address (often free or for a small fee),
- use IPv6 if the ISP provides it. There is no port forwarding then, only a firewall rule on the router allowing traffic to a specific device,
- use an outbound tunnel (WireGuard to a VPS, Cloudflare Tunnel, Tailscale), which requires no open ports.
How to test
The Port checker connects from the routing.pl server to your public address, the one you are viewing the page from right now. Enter up to 10 ports, for example 22, 80, 443, 51820, and run the test.
A few notes:
- Your address only. The tool does not check other people’s hosts, because that would make it a port scanner. For the same reason it allows only a few tests per hour.
- A VPN changes the result. With a VPN on, the VPN’s exit address is checked, not your connection.
- IPv4 or IPv6. If your browser connects over IPv6, the IPv6 address is checked. IPv4 port forwarding has no effect on that; what matters is the router’s IPv6 firewall.
- TCP only. UDP services (WireGuard, many games) do not answer a connection attempt, so no external test can tell “open” from “filtered” for them. Test them by connecting with a real client from outside the network, for example from a phone on mobile data.