About the Port Checker
This tool checks whether a single TCP port is reachable on a host. It resolves the hostname to its public IP, opens one TCP connection to the port you specify and reports a clear verdict: open (something is listening and accepted the connection), closed (the host answered but refused the connection — nothing is listening) or filtered (no response at all before the timeout, which usually means a firewall is silently dropping the traffic). You also get the resolved IP, the well-known service name for common ports and the connect time in milliseconds.
It is the quick way to answer "is this service actually reachable from the outside?" — a mail server on 25, a database on 5432, SSH on 22, a control panel on 2222, or your own app behind a load balancer. The check runs once from our server, so it tests reachability from the public internet rather than from your own network. It performs a single connect, not a port scan: one host, one port at a time. Private, loopback and link-local targets are refused.
How to use it
- Enter a hostname or IP address.
- Enter the TCP port to test (1–65535), or write it as host:port.
- Submit to make a single TCP connection from our server.
- Read the verdict: open, closed or filtered, with the resolved IP and connect time.
Examples
- Confirm a mail server is reachable on port 25 or 587.
- Check whether a database port (3306, 5432) is exposed to the public internet.
- Verify SSH (22) or DirectAdmin (2222) is reachable after a firewall change.
- Tell a closed port (refused) apart from a filtered one (firewalled).
Frequently asked questions
What is the difference between closed and filtered?
Closed means the host replied and actively refused the connection (TCP RST) — it is reachable, but nothing is listening on that port. Filtered means there was no reply at all before the timeout, which typically indicates a firewall silently dropping the packets. Open means the TCP handshake completed.
Is this a port scanner?
No. It makes a single TCP connection to one host and one port that you specify. It does not sweep ranges of ports or hosts. Use it to verify the reachability of a service you operate or are troubleshooting.
Why does it check from your server instead of mine?
The connection originates from our server on the public internet, so it tells you whether a port is reachable from outside your own network. That is exactly what you want when checking a firewall rule or confirming a service is publicly exposed (or correctly not exposed).
Can I check a private or internal address?
No. Private, loopback, link-local and other non-routable addresses are refused, and the hostname is resolved to a public IP before connecting, so DNS cannot be repointed to an internal host. This keeps the tool safe to run as a public service.
Does an open port mean the service is healthy?
It means the TCP port accepted a connection — the first requirement for the service to work. It does not validate the application behind it (a healthy TLS certificate, a correct HTTP response, database auth, and so on). Pair it with the SSL, HTTP or DNS tools for the full picture.
What does the connect time tell me?
It is the time to complete the TCP handshake to the resolved IP, in milliseconds. A high value can indicate network latency or a distant/overloaded host. A timeout (filtered) means no handshake completed within the configured limit.