Check whether the ports a service depends on are actually reachable from the outside. Choose a single port, or sweep the common web and mail ports in one go.
Only a fixed list of common service ports can be checked, and only against public addresses. A port showing filtered means the connection timed out — usually a firewall dropping it silently rather than nothing listening.
Open, closed, or filtered
These three outcomes mean different things, and the difference matters more than the result itself:
- Open — something accepted the connection. A service is listening and reachable.
- Closed — the host answered and actively refused. The machine is up and reachable, but nothing is listening on that port.
- Filtered — the connection timed out with no reply at all. A firewall is dropping the packets silently. This is what a correctly firewalled port usually looks like, and it is the case people misread as “the server is down”.
A port that is closed tells you the host is alive. A port that is filtered tells you nothing except that the packet did not come back — the host could be down, or the firewall could be doing its job.
When to use it
- Before switching a client’s mail over. Check 25, 465, 587, 993 and 995 are not blocked by their office network. ISPs blocking port 25 outbound is still common, and it is a five-second check that saves an hour of confusion.
- After a firewall change. Confirm 80 and 443 are reachable and that nothing else you did not intend is open.
- When a service is unreachable. Distinguishes “the daemon died” from “the firewall is blocking me” before you start restarting things.
- Checking a database is not exposed. 3306, 5432 and 6379 should be filtered from the public internet on almost every server. If they read as open, that is worth looking at today.
What this tool will not do
It is deliberately not a port scanner. It only checks a fixed list of common service ports, and it refuses to probe private or reserved addresses, so it cannot be used to map an internal network. That limitation is the point: a public endpoint that will connect anywhere on your behalf is a liability, not a feature.
Only scan hosts you own or have permission to test. Even a light check leaves entries in the target’s logs, and some providers treat repeated probing as hostile.
If the result surprises you
This check runs from one location on the internet — this server. A port can be reachable from here and blocked from somewhere else entirely, because firewalls and ISP filtering are directional. If a port shows closed but you know the service is running, check whether it is bound to 127.0.0.1 rather than 0.0.0.0: a service listening only on the loopback interface is invisible from outside by design.