Toolkit

Best-effort Port Checker

Check whether a TCP port appears reachable from the public internet, then use the result to narrow down service, firewall, port forwarding, CGNAT, or double NAT problems.

TCP port reachability

Check whether a port looks reachable from the public internet

This best-effort tool asks the server to attempt a TCP connection back to your detected public IP and port. It is useful for port forwarding, CGNAT, and double NAT troubleshooting, but it cannot prove every firewall or ISP behavior.

Detected public IP

Checking...

If this is missing or unexpected, compare it with the WAN IP shown by your router before trusting the result.

Result

Enter a valid port number

Use a TCP port between 1 and 65535. The checker will then try a best-effort public reachability test from the server side.

What to check next

Double-check the port configured in the app or service you are exposing.
Use the same port number in your router forwarding rule and firewall rule if needed.
If you are not sure which port matters, review the service documentation first.

Important note

This checks TCP reachability only. A positive result does not guarantee the app behind the port is configured correctly, and a negative or inconclusive result can still come from filtering, CGNAT, double NAT, or other upstream rules.

Port appears reachable

A successful TCP connection is a strong sign the port is open from the public side, though the app behind it can still be misconfigured.

Port closed or not reachable

A refused connection usually points to the service not listening, the forward being wrong, or the firewall blocking it.

Inconclusive

A timeout or filtered response can happen with CGNAT, double NAT, upstream filtering, or a service that never answered clearly.

Practical troubleshooting next steps

If the port does not look reachable, start with the basics: make sure the service is actually running, confirm the target device firewall allows inbound TCP on that port, and confirm the router forwarding rule points at the correct device and internal port.

If those look right, compare your router WAN IP with your public IP. A mismatch, a private WAN IP, or a shared range such as 100.64.x.x can be a strong sign of CGNAT or another NAT layer upstream.

Keep troubleshooting

Related guides

Tool

CGNAT Checker

Compare your router WAN IP with your detected public IP.

Open tool

Guide