Guide
What is an open TCP port?
Services on the internet listen on numbered doors called ports. An open TCP port means something accepted a connection from the outside.
Why you should care
Port forwarding only works if the public internet can complete a TCP handshake to that port. A checker from outside your LAN is how you verify it.
Unexpected open ports (remote desktop, databases, Docker APIs) are a common way attackers find exposed services.
Ports are just numbers
HTTPS usually uses 443, SSH 22, mail 25/587. The number is a convention; the program listening decides what happens after connect.
One host can have many ports open. Each is a separate door.
Open
The service accepted a connection
- Internet
- Host:port
- Service answers
Closed or filtered
Refused, or silence from a firewall
- Internet
- Firewall or nothing listening
- No usable service
Open, closed, filtered
Open: the handshake succeeded. Closed: the host refused. Filtered: no clear answer — often a firewall drop.
Filtered does not prove the service is down for every network. It only describes this vantage point.
How to check
Use an online TCP port checker against your public IP after you set up forwarding. Test from a network that is not your own LAN if possible.
Only scan machines you own or have permission to test.
Remember
- A check from one network is not a check from every network.
- CGNAT can make home forwarding impossible without extra help from the ISP.
- UDP services need a different kind of probe.
- Unauthorized scanning can be against the law or a host’s terms.
