How to check if a port is open

• Is a program listening on the port? Check on the PC itself.
• Can other devices on the network reach it? Test from another device on the same network. This also tests the PC's firewall.
• Can the internet reach it? Test from outside your network. This also tests the router's port forwarding.

1. 1

   Step 1: See what's listening on the PC

   In Command Prompt, list the listening ports with the ID of the program behind each one:

   netstat -ano | findstr LISTENING
   netstat -ano | findstr :3389

   Or in PowerShell, with the program's name:

   Get-NetTCPConnection -State Listen -LocalPort 3389 | ForEach-Object { Get-Process -Id $_.OwningProcess }

2. 2

   Step 2: Test it from another PC

   In PowerShell on a second PC on the same network:

   Test-NetConnection -ComputerName 192.168.1.20 -Port 3389

   TcpTestSucceeded : True means the port is open and reachable. False with the program listening usually means Windows Firewall is blocking it.

3. 3

   Step 3: Test it from the internet

   Run our open port checker on a device on that network. It checks your own public address on common ports such as 3389, 22, 5900, 80 and 443, and nothing else.

On Linux, list listening ports and the programs behind them:

sudo ss -tulpn
sudo ss -tlpn | grep :22

On a Mac:

sudo lsof -nP -iTCP -sTCP:LISTEN

To test a port on another machine from either one (on Linux, install the netcat package if nc is missing):

nc -zv 192.168.1.20 22

succeeded or open means it's reachable; refused means the machine answered but nothing listens there; a long wait and a timeout usually means a firewall drops it. These tests are for TCP. UDP has no handshake, so a UDP test can't reliably tell an open port from a blocked one.

More on two of them: RDP port 3389 and the SSH port.

Your router has one public address for the whole home or office and drops connections that arrive from the internet unless a rule says which device they're for. A port forwarding rule says: send connections for this outside port to this device and port on the inside.

• Give the device a fixed local address (a DHCP reservation on the router), so the rule keeps pointing at it.
• Add the rule in the router's settings, usually under Port forwarding, NAT or Virtual servers: the outside port, the device's local address, the inside port, TCP or UDP.
• Allow the port in the device's own firewall.
• Test from outside your network. A test from inside the same network can fail even when the rule works, because many routers don't loop connections back in.

The local address to use, and the public one people connect to, are in how to find your IP address.

• Nothing is listening: the program or service isn't running, or listens on a different port.
• The PC's firewall blocks it, or allows it only on Private networks while the network is set to Public.
• The router has no forwarding rule for it, or the rule points at an old local address.
• Your internet provider blocks some ports for home connections.
• Your provider shares one public address between many customers (CGNAT, common on 4G, 5G and satellite internet), so nothing can be forwarded. See remote access behind CGNAT.

If you're opening a port to reach your own PC, there's a simpler way. RemoteAccessApp's app on the PC connects out to our relay, and so does yours, so the router forwards nothing and scanners find nothing new. It works behind CGNAT too. The PC asks before anyone connects unless you switched on unattended access at that PC. Remote desktop without port forwarding explains how.