Ports in One Paragraph
An IP address identifies a machine; a port number identifies a service on it. A web server listens on ports 80 and 443, a mail server on 25, and so on. A port is open when a service is listening and the firewall allows connections to it.
Test From Outside Your Network
Testing from your own computer only shows what is reachable locally. To see what the internet sees, test from outside. Our Port Scanner checks common ports of a host from our server. Only scan systems you own or are authorized to test.
Test From the Command Line
- Windows PowerShell:
Test-NetConnection example.com -Port 443 - macOS and Linux:
nc -vz example.com 443 - Show listening ports on the machine itself:
netstat -an(Windows) orss -tlnp(Linux).
Open, Closed and Filtered
- Open: a service accepted the connection.
- Closed: the host answered but nothing is listening on that port.
- Filtered: no answer at all, usually because a firewall drops the traffic. Most well-configured servers show filtered for everything except their public services.
Common Ports
| Port | Service | Should it be public? |
|---|---|---|
| 80 / 443 | HTTP / HTTPS | Yes, for websites |
| 25 | SMTP (server-to-server mail) | Only on mail servers |
| 465 / 587 | SMTP submission (mail clients) | Only on mail servers |
| 993 / 995 | IMAPS / POP3S | Only on mail servers |
| 53 | DNS | Only on DNS servers |
| 22 | SSH | Prefer restricted to known addresses or a VPN |
| 21 / 23 | FTP / Telnet | Avoid; unencrypted |
| 3389 | Remote Desktop | No; a frequent attack target |
| 3306 / 5432 / 1433 | MySQL / PostgreSQL / SQL Server | No; databases should not be public |
Why Is My Port Closed?
- The service is not running or listens only on
127.0.0.1. - The server’s own firewall (Windows Firewall, ufw, iptables) blocks it.
- A cloud security group or hosting firewall blocks it.
- At home, the router needs a port-forwarding rule, and some providers block certain ports such as 25 and 80.
- Your connection uses carrier-grade NAT, so incoming connections cannot reach you at all.
Security Checklist
- Close every port that does not need to be public.
- Put administrative services (SSH, RDP, database) behind a VPN or allow-list.
- Re-test after every server change.