Network Tools
Port Checker
Check whether a TCP port is reachable on a public host.
Port check
This tool is in development. A checker that opens connections to a host you name is security-sensitive, so it ships only once its protections are operational. The explanation below is complete.
What a port check tells you
Ports let one machine run many services on one address. A port check opens a TCP connection to one of them and reports what happened. Because the connection comes from outside your network, it answers a question you cannot answer from your own machine: is this service actually reachable from the internet?
The three outcomes
- Open — the connection was accepted. A service is listening and reachable.
- Closed — the host replied with a refusal. The host is up and reachable, but nothing is listening on that port.
- Filtered — nothing replied at all. A firewall is dropping the packet silently, which is why this shows up as a timeout rather than an error.
Common ports
| Port | Service | Notes |
|---|---|---|
| 22 | SSH | Remote shell access |
| 25 / 587 | SMTP | Mail transfer and submission |
| 53 | DNS | Name resolution |
| 80 | HTTP | Unencrypted web traffic |
| 443 | HTTPS | Encrypted web traffic |
| 3306 | MySQL | Should rarely be public |
| 5432 | PostgreSQL | Should rarely be public |
| 6379 | Redis | Never expose without auth |
Why a port shows as closed
- The service is bound to localhost. A process listening on
127.0.0.1is unreachable from outside no matter what the firewall says. Bind to0.0.0.0or a specific external interface. - A host firewall is blocking it. Check
ufw,firewalldor the cloud provider's security group — cloud instances usually have two layers. - No port forwarding. On a home connection the router must forward the port to the correct internal device.
- Carrier-grade NAT. If your provider shares one public address across many customers, inbound connections cannot reach you and no amount of configuration will fix it. See the IPv4 checker for how to tell.
- The provider blocks the port. Ports 25, 80 and 445 are commonly blocked on residential connections.
Why this tool is treated as security-sensitive
A feature that makes our server connect to an address a stranger supplies is a
server-side request forgery primitive. Implemented naively it can be pointed at
private networks, at localhost, or at cloud metadata endpoints such as
169.254.169.254 — which on an unprotected instance can return credentials.
The implementation therefore has to do all of the following, and IPGet's does:
- Validate the hostname and reject internal-only names outright.
- Resolve the name and verify that every resulting address is globally routable — no private, loopback, link-local, carrier-NAT or reserved ranges.
- Connect to the resolved address rather than the hostname. Re-resolving at connect time allows DNS rebinding, where a name returns a public address for the check and a private one microseconds later. Pinning the validated address is the only reliable defence.
- Restrict checks to a fixed list of well-known service ports, so the tool cannot be used as a general scanner.
- Apply short timeouts, per-address rate limits, and report only open, closed or error — never internal error detail, which would leak network topology.
Every one of those guards is implemented and unit tested in this codebase today. What is deliberately not yet enabled is the outbound connection itself, because it needs a deployment decision about egress restrictions. Shipping the interface before that would mean shipping the risk without the containment.
Frequently asked questions
What does a port checker do?
It attempts a TCP connection to a specific port on a public host and reports whether the connection was accepted, refused or timed out. It tells you whether a service is reachable from the outside internet, which is different from whether it is running locally.
What is the difference between an open, closed and filtered port?
Open means something accepted the connection. Closed means the host actively refused it, so the host is reachable but nothing is listening. Filtered means nothing answered at all — usually a firewall silently dropping the packet, which is why it presents as a timeout rather than a refusal.
Why does my port show as closed when my service is running?
Most often a firewall or the absence of port forwarding. Check that the service listens on all interfaces rather than 127.0.0.1, that the host firewall allows the port, that your router forwards it, and that your provider does not block it. If you are behind carrier-grade NAT, inbound connections cannot reach you at all.
Is it legal to scan ports?
Checking a port on infrastructure you own or administer is routine. Scanning hosts you have no relationship with can breach computer-misuse law and almost certainly breaches your provider’s terms. Only check hosts you are responsible for.