How to Check If a Port Is Open: Remote and Local Tests

What a TCP port is

A port is a number from 0 to 65535 that tells the operating system which application should handle incoming data. One server can run web on 443, SSH on 22 and mail on 25 at the same time. Ports 0-1023 are reserved for well-known services, 1024-49151 are registered to common applications, and 49152-65535 are dynamic, mostly used for outgoing connections.

Common ports and what runs on them

• 20 / 21 — FTP data and control
• 22 — SSH
• 25 — SMTP (outgoing mail)
• 53 — DNS (TCP and UDP)
• 80 — HTTP
• 443 — HTTPS
• 3306 — MySQL / MariaDB
• 3389 — Remote Desktop (Windows)
• 8080 — common alternate HTTP port
• 8443 — common alternate HTTPS port

Open, closed, filtered

A port check result falls into three categories, and each means something different:

• Open: the TCP handshake completed. A service is listening and reachable.
• Closed: the host answered but refused. Nothing listens on that port, or the service isn't running.
• Filtered: no answer at all. A firewall dropped the packets. You can't tell from one test whether the port is blocked, the host is down, or the route is broken.

Checking ports from your machine

These commands attempt a real TCP connection, exactly like the online checker does, just from your own network.

Test-NetConnection example.com -Port 443

nc -zv example.com 443

telnet example.com 443

Why your own network is a bad witness

NAT hairpinning: when you connect to your own public IP from inside the house, the router often loops the traffic back inside without ever touching the path an outside visitor would take. Your service can pass a local test while being invisible to the rest of the internet.

A remote check from a different network tests the real path. If the port accepts a connection from a Globalping probe, your port forwarding and firewall rules are actually working.

What the online port checker does

Enter the host and port, pick a region, run it. One probe attempts a single TCP connection to that one port. This is a reachability check, not a scanner, so it never sweeps a host. The answer tells you whether the outside world can reach that port from that location, which is the exact question you're trying to answer after setting up port forwarding or opening a firewall rule.

Summary: the port check proves the service layer

Online ping proves the host is reachable; a port check proves the service actually accepts connections. Run the local commands for your own LAN, then confirm from a remote probe — that second view is the one that catches NAT hairpinning, missing forwarding rules and firewalls that only matter from the outside.

• Open means the handshake completed; filtered means no answer came back at all.
• A local success proves nothing about the public path — always retest from outside.
• Check one port per run; this is a reachability tool, not a scanner.