PortCheckPortCheck
← All guides

Why Is My Port Closed? A Troubleshooting Checklist

Systematically isolate the layer that's blocking your connection

A port can appear closed for many unrelated reasons, and the fix depends entirely on which layer is responsible. Rather than guessing, work through the checklist below from the application outward — it's the fastest way to find the actual cause.

1. Confirm the Application Is Actually Listening

Before touching any firewall settings, confirm the service is running and bound to the expected port. On Linux/macOS, run sudo lsof -i :PORT or ss -tlnp | grep PORT. On Windows, run netstat -ano | findstr :PORT. If nothing is listed, the application isn't running or crashed on startup — check its logs first.

Also check whether it's bound to 127.0.0.1 (localhost only) instead of 0.0.0.0 or your machine's LAN address. A service bound only to localhost will never be reachable from outside the machine, no matter what your firewall or router does.

2. Check the Operating System Firewall

Even with the application listening correctly, the OS firewall can silently drop inbound packets. Review:

  • Windows: Windows Defender Firewall → Advanced Settings → Inbound Rules.
  • Linux (ufw): sudo ufw status verbose — look for a rule allowing the port.
  • Linux (iptables/nftables): sudo iptables -L -n or sudo nft list ruleset.
  • macOS: System Settings → Network → Firewall → Options.

3. Check Cloud / VPS Security Groups

If your server runs on a cloud provider, an OS-level firewall rule is not enough — the provider's network layer has its own separate rules that take precedence. Check AWS Security Groups and Network ACLs, GCP Firewall Rules, Azure Network Security Groups, or the equivalent on your provider (Fly.io, DigitalOcean, Hetzner, etc.). A common mistake is opening the port in the OS firewall but forgetting the cloud console rule, or vice versa.

4. Check Your Router's Port Forwarding

For home networks, confirm a forwarding rule exists pointing the external port to the correct internal IP and port. See our port forwarding guide for the full walkthrough, including the common trap of a device's local IP changing after a router reboot.

5. Rule Out Carrier-Grade NAT (CGNAT)

If you've verified every setting above and the port still isn't reachable, your ISP may not be giving you a real public IP at all. Many mobile and some residential ISPs place customers behind Carrier-Grade NAT, meaning the IP address your device sees is not the same one used on the public internet — no router configuration can fix this. Compare the IP shown in your router's status page against the IP detected by PortCheck. If they differ, you're likely behind CGNAT and will need to contact your ISP for a dedicated IP or use an alternative such as a VPN with port forwarding support or a reverse tunnel service.

6. Check for ISP-Level Port Blocking

Some ISPs block specific inbound ports outright regardless of your own configuration — port 25 (SMTP) is the most commonly blocked to reduce spam origination from residential connections. If a specific well-known port never works despite everything else being correctly configured, try a different port number to see if the issue is port-specific.

Quick Reference: Result Meaning

  • Connection refused: Something responded and actively rejected the connection — usually means nothing is listening, or a firewall is sending back a rejection instead of dropping silently.
  • Timed out: No response at all — most consistent with a firewall silently dropping the packet somewhere along the path.
  • Open/reachable: The TCP handshake completed successfully — the application, firewalls, router, and ISP are all correctly configured for this port.