Complete Guide to TCP Port Checking and Firewall Testing
In computer networking, a port is a logical endpoint that identifies a specific process or service running on a host. The TCP/IP protocol suite supports 65,535 available TCP ports, divided into three ranges: well-known ports (0-1023) assigned by IANA to standard protocols like HTTP, SSH, and SMTP; registered ports (1024-49151) used by vendor-specific applications such as MySQL, PostgreSQL, and game servers; and dynamic or private ports (49152-65535) used for ephemeral client-side connections.
When our tool checks a port, it initiates a TCP three-way handshake. Your browser sends a SYN (synchronize) packet to the target host on the specified port. If the service is running, the host responds with a SYN-ACK (synchronize-acknowledge) packet, and our server completes the handshake with an ACK packet. A port is considered "open" when this handshake completes successfully, "closed" when the host responds with a RST (reset) packet indicating no service is listening, and "filtered" when no response is received because a firewall is silently dropping the packets.
Port checking is an essential practice for server administration, security hardening, and troubleshooting network connectivity. Whether you are deploying a web application, configuring a mail server, or setting up remote access to your home network, verifying that the correct ports are accessible from the public internet is the first step in confirming your infrastructure is working as intended.
Port Forwarding and NAT Explained
Network Address Translation (NAT) is the process your router uses to share a single public IP address among all the devices on your local network. When a device on your LAN sends a request to the internet, the router replaces the private source IP with its own public IP and keeps track of the mapping in a translation table. This works seamlessly for outgoing connections, but incoming connections from the internet have no way to reach a specific device behind NAT unless you configure port forwarding rules.
Port forwarding tells your router to direct all incoming traffic on a specific port to a designated device on your local network. For example, forwarding TCP port 25565 to your gaming PC at 192.168.1.50 allows external players to connect to your Minecraft server. UPnP (Universal Plug and Play) can automate this process by allowing applications to request port forwards dynamically, though it introduces security risks and is often disabled on enterprise networks. As a last resort, placing a device in the routers DMZ (Demilitarized Zone) forwards all ports to that device, but this exposes it to the entire internet without any port filtering.
It is important to understand the security implications of open ports. Every open port is a potential entry point for attackers. Only forward the ports that are absolutely necessary, keep the services behind them updated and patched, and use strong authentication. Port triggering is a more secure alternative that only opens an inbound port temporarily when an outbound connection is detected on a trigger port, reducing the attack window compared to static port forwarding.
Comprehensive Port Reference Guide
Not sure which port to test? Here are the standard ports for the most commonly used internet services and their security considerations:
| Port |
Protocol |
Service |
Security Notes |
| 20-21 | TCP | FTP (Data/Control) | Transmits credentials in plain text. Use SFTP (port 22) instead. |
| 22 | TCP | SSH / SFTP | Secure but frequently targeted by brute-force bots. Use key-based auth. |
| 25 | TCP | SMTP | Often blocked by ISPs to prevent spam. Use port 587 for submission. |
| 53 | TCP/UDP | DNS | Should only be open on DNS servers. Can be abused for amplification attacks. |
| 80 | TCP | HTTP | Unencrypted web traffic. Redirect to HTTPS (443) in production. |
| 110 | TCP | POP3 | Legacy email retrieval. Use POP3S (995) with TLS encryption. |
| 143 | TCP | IMAP | Email access protocol. Use IMAPS (993) with TLS for security. |
| 443 | TCP | HTTPS | Encrypted web traffic via TLS. The standard for all modern websites. |
| 3306 | TCP | MySQL | Never expose directly to the internet. Use SSH tunnels or VPN access. |
| 3389 | TCP | RDP | High-value target for ransomware. Use VPN or change default port. |
| 5432 | TCP | PostgreSQL | Restrict to trusted IPs via pg_hba.conf. Never expose publicly. |
| 8080 | TCP | HTTP Alternate | Common for development servers, proxies, and application containers. |
| 25565 | TCP | Minecraft | Only open when actively hosting. Use whitelist to limit access. |
| 27015 | TCP/UDP | Source Engine (CS2, TF2) | Game traffic only. Consider using RCON password protection. |