---
title: I opened the port, so why can't I connect? How to check with the Port Checker
description: You added the firewall rule, restarted the service, and the connection still times out. To check if a port is open, try a TCP connection to it from outside your network: open, refused and no answer at all each point to a different fix. Here's how to test any port in seconds with the free Port Checker, how to read the result and the server banner, and the nc commands that confirm it.
canonical: https://watchfor.io/blog/how-to-check-if-a-port-is-open
---

# I opened the port, so why can't I connect? How to check with the Port Checker

2026-10-04 · WatchFor Team · Guides · guides, networking, security

You added the firewall rule, restarted the service, and the connection still times out. To check if a port is open, try a TCP connection to it from outside your network: open, refused and no answer at all each point to a different fix. Here's how to test any port in seconds with the free Port Checker, how to read the result and the server banner, and the nc commands that confirm it.

To check if a port is open, try to open a TCP connection to it from a
machine outside your network. There are three possible outcomes. If the
handshake completes, the port is open and something is listening. If the
server answers with a reset, the port is closed: the host is reachable and
nothing listens there. If nothing comes back at all, a firewall is silently
dropping the packets.

The free [Port Checker](/port-checker) makes that connection from a WatchFor
location, reports whether the port is open and how long the connect took,
and shows the first line the service sends, such as an SSH or SMTP banner.
No signup.

## What this tool answers

*Can the internet reach this service on this port?* Reach for it after you
open a port in a security group, cloud firewall or router; when a client
reports "connection timed out"; before you tell someone a database or SSH
port is closed to the world; or to confirm what software answers on a port.
Testing from your own network proves little: your machine may be inside the
firewall, or allowed by a rule that outsiders don't match.

## A real example

### Checking if a port is open from outside your network

The classic ticket: "I can't SSH into the server, but the firewall rule is
there." Before anyone touches the server, it pays to know which of the three
outcomes you have. We used two public hosts to show the two you'll see most.

In the [Port Checker](/port-checker) we entered `github.com`, picked
**22 SSH** from the common ports and left **Try to read server banner** on:

![The Port Checker result for github.com port 22: OPEN, 24 ms connect time, DNS 33 ms, connect 24 ms, first byte 209 ms, and the server banner SSH-2.0-2097ddd](/blog/how-to-check-if-a-port-is-open-open.webp)

The connection completed in 24 ms after a 33 ms DNS lookup, and 209 ms in,
the server sent its first line: `SSH-2.0-2097ddd`. An SSH server identifies
itself with `SSH-2.0-` followed by its software version as soon as you
connect (RFC 4253). So port 22 is open, and the thing listening on it really
is SSH, not a web server on the wrong port. That's what an SSH problem looks
like when the network is fine: if your client still fails here, look at keys
and users, not firewalls.

Then the same check against `example.com`, port 22:

![The Port Checker result for example.com port 22: Probe failed, no response from port 22 on example.com, it is closed or filtered by a firewall](/blog/how-to-check-if-a-port-is-open-closed.webp)

No handshake and no reset: the probe waited out its 6-second timeout. That
is a firewall dropping the packets. `example.com` sits behind Cloudflare's
proxy, which only accepts web traffic, so this is the expected answer for
that host.

**The answer:** for GitHub, port 22 is open and speaks SSH. For
`example.com` it is filtered. If that second result were your own server
after you "opened the port", the packets are being dropped before they reach
the service, and the fix is in a firewall, not in the service config. The
order to check: the cloud security group or network ACL, then the host
firewall (`ufw status`, `firewall-cmd --list-all`, `nft list ruleset`), then
any router port forward. A refused result would instead mean the packets
arrive and nothing is listening: check that the service is running and bound
to the public interface (`ss -tlnp`), not only to `127.0.0.1`.

## How to read the results

| What you see | What it means |
| --- | --- |
| **OPEN** | The TCP handshake completed: something accepted the connection. |
| **Connect time (hero)** | Time for the handshake, roughly one round trip to the host. Green under 50 ms, amber under 200 ms, red above. |
| **DNS** | Time to resolve the host name before connecting. Not shown when you enter an IP. |
| **First byte** | Time until the service sent its first data, the banner. |
| **Server banner** | The first line the service sent, e.g. `SSH-2.0-…`, `220 mail.example.com ESMTP`. It tells you what software is listening. |
| **No banner** | The connection was accepted but the server said nothing. Normal for HTTP, HTTPS and databases, where the client speaks first. |
| **Connection refused** | The host answered with a reset: reachable, but nothing listens on that port. |
| **No response … closed or filtered** | Nothing came back before the timeout: a firewall drop, a host that's down, or a route that goes nowhere. |

The quick buttons (22 SSH, 25 SMTP, 443 HTTPS, 3306 MySQL, 5432 Postgres,
6379 Redis…) fill in the port; any port from 1 to 65535 works.

## More ways to use it

- **Prove a database isn't exposed.** Run it against your database host on
  3306, 5432, 6379 or 27017. You want *filtered* or *refused*. If it says
  OPEN, the database is reachable from the whole internet.
- **Test a router port forward.** Check your public IP (find it with
  [What Is My IP](/whats-my-ip)) on the forwarded port. If it fails while the
  service works locally, the forward, the router firewall or CGNAT is the
  problem.
- **Check a mail server.** Port 25 should be open with a `220` banner on an
  inbound mail server; 587 and 465 on a submission server. The
  [SMTP test](/smtp-test) goes further with EHLO and STARTTLS.
- **Confirm a migration.** After moving a service, check that the new
  address answers on the port and that the banner names the new software
  version.
- **Find where it breaks.** Filtered from outside but fine inside? Run a
  [traceroute](/traceroute-online) to see how far packets get.

## Tips and gotchas

- **Filtered ≠ down.** A timeout looks the same whether a firewall drops the
  packet or the machine is off. [Ping](/ping-test) the host to tell them
  apart, but remember many hosts drop ping too.
- **It tests TCP only.** UDP has no handshake, so DNS on 53/udp, NTP on
  123, WireGuard or game servers can't be tested this way. Use a
  protocol-specific test such as the [NTP server test](/ntp-test).
- **Location matters.** Logged out, the check runs from the location
  nearest you, over IPv4. A firewall that allows only certain countries or
  addresses can give different answers elsewhere.
- **Open isn't the same as working.** An accepted connection can still lead
  to a TLS error, a login failure or an HTTP 500. Open only proves the port.
- **Some services rate-limit or tarpit.** SSH servers with connection limits
  or fail2ban may drop repeated connections from the same address.
- **Private addresses can't be checked.** `10.x`, `192.168.x` and other
  internal ranges aren't reachable from the internet, so the tool rejects
  them. Test those from inside the network.

## Check it from the command line too

`nc` (netcat) does the same handshake; `-z` connects without sending data,
`-v` prints the outcome, `-w` sets the timeout:

```bash
nc -vz -w 5 github.com 22
nc -vz -4 -w 5 example.com 22
nc -vz -w 3 localhost 9
```

```text
Connection to github.com (140.82.121.4) 22 port [tcp/ssh] succeeded!
nc: connect to example.com (172.66.147.243) port 22 (tcp) timed out: Operation now in progress
nc: connect to example.com (104.20.23.154) port 22 (tcp) timed out: Operation now in progress
nc: connect to localhost (127.0.0.1) port 9 (tcp) failed: Connection refused
```

All three outcomes in one go: open, filtered (`timed out`, tried on both of
example.com's addresses) and closed (`Connection refused`, on a local port
where nothing listens). To read the banner, connect without `-z`:

```bash
nc -w 3 github.com 22 </dev/null | head -1
```

```text
SSH-2.0-2097ddd
```

The same string the Port Checker showed. On Windows PowerShell,
`Test-NetConnection github.com -Port 22` reports `TcpTestSucceeded : True` or
`False`. Run these from a machine *outside* the network you're testing,
or they tell you about your internal path, not the internet's.

## Keep watching it

A port that's open today can be closed tomorrow by a firewall change, a
crashed service or an expired allowlist entry. A [TCP monitor](/tcp-monitoring)
connects to `host:port` on a schedule from the locations you choose, records
the DNS, connect and optional TLS timings, and opens an incident when
connections are refused, unreachable or time out, after re-checking from other
locations. The **Response Match** rule can send a string and check the reply,
for example that port 22 still answers `SSH-2.0`.

## FAQ

**How do I know if a port is blocked by a firewall?**
If a connection to the port times out with no reply, a firewall is
dropping it. If it is refused immediately, the packets reach the host and
nothing is listening. [What is a firewall?](/blog/what-is-a-firewall)
explains the difference between dropping and rejecting.

**Why is my port closed even though I opened it in the firewall?**
The service may be listening only on `127.0.0.1`, a second firewall (cloud
security group, host firewall, router) may still block it, or your ISP may
use CGNAT so inbound connections never reach your router.

**What does connection refused mean?**
The host is up and answered, but no program accepts connections on that
port. Start the service or fix the port it binds to.
[ERR_CONNECTION_REFUSED](/blog/connection-refused) covers the browser side,
and [what is a network port](/blog/what-is-a-network-port) the basics.

---

Canonical page: https://watchfor.io/blog/how-to-check-if-a-port-is-open · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt