Toolkit

Best-effort Port Checker

Check whether a TCP port appears reachable from the public internet, then use the result to narrow down service, firewall, port forwarding, CGNAT, or double NAT problems.

TCP port reachability

Check whether a port looks reachable from the public internet

This best-effort tool asks the server to attempt a TCP connection back to your detected public IP and port. It is useful for port forwarding, CGNAT, and double NAT troubleshooting, but it cannot prove every firewall or ISP behavior.

Your public IP

Checking...

If this is missing or unexpected, compare it with the WAN IP shown by your router before trusting the result.

Result

Enter a valid port number

Use a TCP port between 1 and 65535. The checker will then try a best-effort public reachability test from the server side.

What to check next

1.Double-check the port configured in the app or service you are exposing.
2.Use the same port number in your router forwarding rule and firewall rule if needed.
3.If you are not sure which port matters, review the service documentation first.

TCP only. This checks TCP reachability only. A positive result does not guarantee the app behind the port is configured correctly, and a negative or inconclusive result can still come from filtering, CGNAT, double NAT, or other upstream rules.

Port appears reachable

A successful TCP connection is a strong sign the port is open from the public side, though the app behind it can still be misconfigured.

Port closed or not reachable

A refused connection usually points to the service not listening, the forward being wrong, or the firewall blocking it.

Inconclusive

A timeout or filtered response can happen with CGNAT, double NAT, upstream filtering, or a service that never answered clearly.

Practical troubleshooting next steps

If the port does not look reachable, start with the basics: make sure the service is actually running, confirm the target device firewall allows inbound TCP on that port, and confirm the router forwarding rule points at the correct device and internal port.

If those look right, compare your router WAN IP with your public IP. A mismatch, a private WAN IP, or a shared range such as 100.64.x.x can be a strong sign of CGNAT or another NAT layer upstream.

Free option first

Ask your ISP about a public IPv4

If the local service, firewall, and forwarding rule look correct, ask whether the connection uses shared IPv4 and whether a public IPv4 is available.

Browse ISP guides

Paid optionAffiliate link

PureVPN

Need port forwarding behind CGNAT?

If your ISP cannot provide a public IPv4 and you specifically need inbound port forwarding, PureVPN offers an optional paid port-forwarding feature that may help for some use cases.

It does not universally remove CGNAT. Check supported locations, protocols, and ports before buying.

Check PureVPN port forwarding

CGNAT Check may earn a commission at no additional cost to you. Check the provider's current port, protocol, plan, and location support before buying.

Compare all solutions

Keep troubleshooting

Related guides

Tool

CGNAT Checker

Compare your router WAN IP with your detected public IP.

Open tool

Guide