How to check if a port is open (and what to do if it's not)

When a service "isn't reachable," the culprit is almost always a port. A port is a numbered doorway on a server — 22 for SSH, 80 for HTTP, 443 for HTTPS, 3306 for MySQL. If the door is closed or blocked, the service behind it might be running perfectly and still be invisible to the outside world. Here's how to test a port and fix it when it's shut.

Open, closed, filtered — the three outcomes

A port check has three possible results, and knowing the difference saves hours:

• Open — something is listening and accepting connections. Good.
• Closed — the port is reachable but nothing is listening. The server refuses the connection (you'll often see "connection refused").
• Filtered — a firewall is silently dropping your packets, so you get no answer at all (the connection "times out"). This is the most confusing case because the service may be running fine behind the firewall.

Timeout vs refused is the single most useful signal: refused means you reached the machine but no service answered; timeout usually means a firewall ate the request.

Checking a port from your own machine

On macOS or Linux, nc (netcat) is the quickest test:

nc -zv example.com 443

-z just scans without sending data; -v prints the result. You'll see "succeeded" for open or an error otherwise.

Prefer nmap for detail:

nmap -p 22,80,443 example.com

On Windows PowerShell:

Test-NetConnection example.com -Port 443

To see what's listening on the server itself, log in and run:

sudo ss -tulpn

This lists every listening port and the process behind it — the fastest way to confirm your service is actually bound.

The catch: checking from the internet, not just locally

A port can be open on the server yet blocked before it reaches the internet. If you test from the same machine (or the same network), you're not seeing what the outside world sees. That's why an external port checker matters — it connects from a remote host, exactly like a real visitor would, and tells you whether the port is truly reachable across the public internet.

What to do when a port is closed or filtered

Work through it from the inside out:

1. Is the service running?

sudo systemctl status nginx
sudo ss -tulpn | grep :443

If nothing is listening on the port, start or fix the service first — no firewall change will help.

2. Is it bound to the right address?

A service bound to 127.0.0.1 only accepts local connections. To be reachable externally it must listen on 0.0.0.0 (all interfaces) or the server's public IP. Check the app's config for a bind or listen directive.

3. Is the host firewall blocking it?

On Ubuntu/Debian with UFW:

sudo ufw allow 443/tcp
sudo ufw status

With nftables or iptables, confirm there's an accept rule for the port.

4. Is there a firewall in front of the server?

Many cloud providers put a network firewall or security group ahead of the VM. If the host firewall allows the port but it's still filtered, this is usually why. On Nxeon your VPS has its own public IP and you control the firewall directly, so there's no hidden layer second-guessing your rules — what you allow is what's open.

5. Right protocol?

Most services are TCP, but some (DNS, some game servers, WireGuard) are UDP. Make sure you're testing and allowing the correct protocol.

A quick troubleshooting order

1. Confirm the service is listening (ss -tulpn).
2. Confirm it's bound to a public interface, not just localhost.
3. Open the port in the host firewall.
4. Open it in any upstream/cloud firewall.
5. Test again from an external checker.

Follow that sequence and you'll rarely be left guessing.

Test any port in seconds

Use our free port checker at /tools/port-checker to test whether a port on any host is open from the public internet. It connects remotely, so you see exactly what your users see — not just what's reachable from your own laptop.

Running the service yourself? Nxeon gives you a VPS with a dedicated public IP and full control over your firewall, so opening a port is one command and there are no surprise upstream blocks. Explore plans at /vps.