What does a closed port mean?

Every service waits for connections on a port: the web on 443, SSH on 22. When CheckNet says a port is closed, the TCP connection did not complete: either nothing is listening on that port, or something on the way (a firewall, your router or your provider) refused it or left it unanswered.

The test runs from the Cloudflare data centre near you, outside your network, just like someone on the internet trying to reach your service. A service that works on the machine itself can still be closed from outside.

From the service to the internet, step by step

1. Make sure the service is really running and listening on that port. On Linux list listening ports with ss -tlnp; on Windows with netstat -ano.
2. Check the listen address. A service listening only on 127.0.0.1 can only be reached from the machine itself; set it to 0.0.0.0 (all interfaces) or the machine’s network address in the service’s settings.
3. Check the operating system’s firewall and open only that port: on Ubuntu, for example, ufw allow 443/tcp; on Windows, an inbound rule in Windows Defender Firewall.
4. On a cloud server, also check the provider’s firewall or security group in its panel. That layer is separate from the OS firewall and usually blocks everything by default.
5. If the service is at home or in an office behind a router, find the section called something like “Port Forwarding”, “Virtual Server” or “NAT” in the router’s panel and forward the outside port to the device’s internal address and port. The name and place differ on every router; see your model’s manual.
6. Give the device a fixed internal address (or reserve it in the router) so the forwarding does not break when it restarts.
7. Check again with CheckNet. For your own IP, use “Open port on my IP” on the “My device” page.

When none of that works: CGNAT and your provider

Many mobile and some home connections have no public IP of their own: the provider shares one public IP between several customers (CGNAT). Connections from outside then never reach your router, and no router setting can open a port.

• To tell, compare the WAN or internet address on your router’s status page with the IP CheckNet shows. If they differ, you are behind the provider’s NAT.
• A WAN address in 100.64.0.0/10 (100.64.0.0 to 100.127.255.255) is a clear sign of CGNAT; that range is reserved for exactly this. Addresses starting with 10., 172.16. to 172.31. or 192.168. are private too.
• Ways out: ask your provider for a public (usually static) IP, use IPv6 if your provider offers it, or put the service on a cloud server or behind a tunnel.
• Some providers also block a few ports for all customers (for example 25 for email, or Windows file-sharing ports). If only one port is closed and others are open, try the service on another port or ask the provider’s support.

Every port you open is visible to the whole internet, and bots probe it constantly. Do not expose router admin panels, databases or Windows Remote Desktop (RDP on 3389) directly; for remote access use a VPN or SSH with keys.

Check it with CheckNet

On CheckNet’s “Port check” page, enter a name or IP and pick one of the common ports (443, 80, 22, 53, 853, 993, 995, 3389, 5222, 8080 and 8443) to see the connect time. Private addresses are not tested, and sites behind Cloudflare’s proxy cannot be tested this way; CheckNet tells you when that happens.