Why are localhost and private RFC 1918 IPs blocked?

To enforce strict P0 security against Server-Side Request Forgery (SSRF), all queries targeting loopback addresses (127.0.0.1), RFC 1918 private subnets (10.x, 172.16.x, 192.168.x), cloud metadata endpoints (169.254.169.254), and internal hostnames are strictly blocked.

Does this tool support UDP port checks?

No. This tool specifically checks TCP three-way connection establishment (SYN, SYN-ACK, ACK). UDP is connectionless and cannot be reliably verified without service-specific application layer payloads.

Is rate limiting enforced?

Yes. To prevent abusive port scanning and adhere to responsible networking guidelines, a rate limit of 30 single-port checks per minute per client IP is automatically enforced.

What is the difference between CLOSED and TIMEOUT (Filtered)?

CLOSED means the target server is online and reached, but actively returned an immediate TCP RST (Reset) flag indicating no service is listening on that port. TIMEOUT (Filtered) means no response was received within 2500ms, typically because a stateful firewall dropped the incoming SYN packet without replying.

Utility #4P0 SSRF Protected

Open Port Checker & TCP Scanner

Test whether a specific TCP port is open and accessible from the public internet. Verify server firewalls, router port forwarding, and web application reachability safely.

Loading Port Checker engine...

Firewall & Port Reachability Guide

Understanding TCP Port Statuses & Firewalls

When a TCP connection is initiated, the client sends a synchronization (SYN) packet. The destination host responds based on whether a listening daemon is bound to that port and whether firewall rules permit traffic.

OPEN (SYN-ACK Received)

The target host responded with a SYN-ACK packet. A server daemon (such as Nginx, Apache, or OpenSSH) is actively listening and accepting inbound TCP handshakes.

CLOSED (RST Received)

The remote host is online and reachable, but sent an immediate RST (reset) flag indicating that no application or server daemon is currently bound to that port.

TIMEOUT (Filtered / Silently Dropped)

No response was received within the 2500ms timeout window. A security appliance, cloud security group, or firewall (like iptables or AWS SG) is silently dropping packets.

Common Network Ports & Services Cheat Sheet

Standard TCP port numbers, associated protocols, application services, and network security recommendations.

Download 1-Page PDF

Port	Service Name	Protocol	Security Best Practice
21	FTP (File Transfer)	TCP (Cleartext)	Deprecated for production. Migrate to SFTP on Port 22.
22	SSH / SFTP	TCP (Encrypted)	Use SSH keys, disable root password login, restrict to VPN.
25	SMTP (Mail Routing)	TCP	Inbound mail only. Outbound Port 25 is blocked by most ISPs.
53	DNS	TCP / UDP	TCP used for zone transfers and responses exceeding 512 bytes.
80	HTTP (Web)	TCP (Cleartext)	Enforce permanent 301 redirect to HTTPS (Port 443).
443	HTTPS (Secure Web)	TCP (TLS Encrypted)	Standard for web. Keep TLS 1.2/1.3 enabled and auto-renew certificates.
3306	MySQL / MariaDB	TCP	NEVER expose to public internet. Keep inside private VPC.
5432	PostgreSQL	TCP	Restrict access to application servers via firewall rules.
8080	HTTP-Alt / Dev Web	TCP	Commonly used for proxying, microservices, or local dev tunnels.

Dedicated Port Guides & Testing Pages

Explore comprehensive technical documentation, RFC specifications, firewall configurations, and live testing tools for all 25 common ports:

Checking SMTP or mail server ports (25, 465, 587)?

Verify SPF records, evaluate DMARC policies, and check DKIM selectors to protect your email deliverability.

Launch Email Security Checker

Frequently Asked Questions

Common questions regarding port checks, firewall troubleshooting, and security policies.

Ensure your web server daemon (Nginx, Apache, or Caddy) is running, your cloud firewall (e.g. AWS Security Group or DigitalOcean firewall) allows inbound TCP traffic on ports 80/443, and your router port forwarding is correctly routed.