Firewall Test: Scan Your Open Ports and Check VPN Leaks
Our server tries to connect to 20 common ports on your public IP, the same way an attacker's scanner would, and your browser checks whether WebRTC reveals an IP address your VPN should hide.
- Real scan from outside
- Only your own IP
- No sign-up
Ready to test
Press Start test. It takes about 5 seconds.
Your public IP
–
The address websites and our scanner see.
WebRTC leak test
Not run yet
Checks if WebRTC reveals a different IP, such as your real one behind a VPN.
Inbound port scan
| Port | Service | Result |
|---|---|---|
| Results appear here after the scan. | ||
What to do next
Fair use: 3 scans per hour. Repeat clicks within 10 minutes show the same result.
How this firewall test works
A real scan from outside
A web page can't scan your own network, so our server does it from the internet side. It opens one connection to each port on your public IP at the same time and waits 2.5 seconds for answers.
A real WebRTC comparison
Your browser asks two public STUN servers which IP it appears from. If that differs from the IP our server sees, WebRTC is exposing an address that should stay hidden.
What a browser can't test
Outbound port blocking, your DNS server and devices inside your network can't be measured from a web page, so this tool doesn't pretend to. There's no made-up score.
Check it yourself. Open your browser's developer tools (F12) and choose the Network tab before pressing Start test. You'll see two requests to our site (your IP and the scan) and WebRTC traffic to STUN servers run by Cloudflare and Google. Nothing is sent anywhere else.
Questions this firewall test answers
Find the situation you're in. Each answer points to the part of the test that settles it.
| Your situation | What the test tells you | Action |
|---|---|---|
| Home and office networks | ||
| Is my router exposing anything to the internet? | The port scan lists every tested port that accepts connections. All Stealth or Closed means nothing common is reachable. | |
| I set up CCTV or a DVR for remote viewing | Ports 554, 8000 and 37777 show whether the recorder is reachable. If Open, change its default password and prefer the maker's cloud app. | |
| My port forwarding for gaming or a server doesn't work | If the forwarded port shows Stealth, your provider may use carrier-grade NAT, so connections never reach your router. | |
| VPN and public Wi-Fi | ||
| My VPN is on. Is my real IP leaking? | The WebRTC test compares the IP WebRTC reveals with the one websites see. A different public IP means a leak. | |
| I'm on café, hotel or airport Wi-Fi | The scan tests the hotspot's public IP, not your laptop. To protect your device there, keep your system firewall on and use HTTPS or a VPN. | |
| Remote Desktop or file sharing shows Open | Ports 3389 and 445 open to the internet are a common ransomware entry point. Close the port forwarding today and use a VPN for remote access. | |
How to read your results
For every port, our server starts a normal TCP connection to your public IP and waits up to 2.5 seconds for one of three answers.
Stealth is the best result, because a scanner learns nothing. Closed is fine, though it confirms a device is there. Open is only acceptable when you run that service on purpose and keep it updated with a strong password.
The WebRTC test gathers the addresses your browser offers for peer-to-peer connections. Private addresses hidden as .local names are normal. A public address from a different network than the one our server sees means WebRTC is sidestepping your VPN or proxy.
With IPv6, one device often uses several addresses from the same network block, and changes them regularly for privacy. The test treats addresses in the same /64 block as yours, so they don't count as a leak.
Sources: RFC 9293 (TCP), RFC 8489 (STUN), RFC 8981 (IPv6 temporary addresses), RFC 6598 (carrier-grade NAT).
The 20 ports we test, and why they matter
| Port | Service | Why it matters |
|---|---|---|
| 21 | FTP | Old file transfer. Sends passwords unencrypted. |
| 22 | SSH | Remote login. Constantly targeted by password-guessing bots. |
| 23 | Telnet | Unencrypted remote login, common on old routers and IoT devices. |
| 25 | SMTP | Mail server. Rarely needed at home. |
| 53 / 110 / 143 | DNS, POP3, IMAP | Name and mail servers. Rarely needed at home. |
| 80 / 443 | HTTP / HTTPS | A web server or your router's admin page. |
| 135 / 139 / 445 | Windows RPC, NetBIOS, SMB | Windows networking. Should never face the internet. |
| 554 | RTSP | Live video from IP cameras. |
| 3389 | Remote Desktop | Windows remote access. A favourite ransomware entry point. |
| 5900 | VNC | Screen sharing, often with weak passwords. |
| 7547 | TR-069 | Your ISP's remote management of the router. |
| 8000 / 37777 | Hikvision / Dahua | CCTV recorders, often left on default passwords. |
| 8080 / 8291 | HTTP alt / MikroTik | Router and device admin panels. |
Firewall mistakes this test often finds
Most exposed ports were opened on purpose once, then forgotten.
Old forwarding rules stay open for years. Review the port forwarding page in your router and delete rules you no longer use.
Devices can open ports without asking you. Turn UPnP off unless a device truly needs it.
Exposed CCTV recorders with default passwords are found within hours. Change the password and update the firmware.
That's your mobile provider's NAT, not your phone. Your phone still needs its own updates and settings.
Habits that keep your firewall tight
Do
- Update your router's firmware, or replace routers that no longer get updates.
- Change the router's admin password from the one printed on the label.
- Use a VPN or your router maker's app for remote access instead of open ports.
- Rerun this test after changing router settings or adding a new device.
- Keep your computer's own firewall switched on, especially on public Wi-Fi.
Avoid
- Placing a device in the router's DMZ.
- Leaving the router's admin page reachable from the internet.
- Opening Remote Desktop, SMB or Telnet to the internet.
- Trusting a single "security score" from any website.
- Scanning networks that aren't yours or that you don't manage.
Frequently asked questions
Short answers about safety, results, NAT, VPN leaks and privacy.
Is it safe to scan my ports with this tool?
Yes. Our server makes one connection attempt to each of 20 common ports on the IP address you are visiting from, and nothing else. It can't scan any other address, it doesn't try passwords or exploits, and it's the same kind of check routers and security teams run on themselves. Only run it on a network you use or look after.
What do Open, Closed and Stealth mean?
Open means something on your network answered and accepted the connection, so that service can be reached from the internet. Closed means your router or computer answered but refused. Stealth means nothing answered at all, which is what a well-configured firewall does.
Why are all my ports Stealth even though I set up port forwarding?
Many internet providers, including most mobile networks and many fibre plans, put customers behind carrier-grade NAT. Your router doesn't have its own public IP, so incoming connections stop at the provider and never reach it. Ask your provider for a public IP if you need to host something.
Can this tool test outbound ports or my DNS?
No. Browsers block web pages from connecting to many ports, including FTP, SSH and email, and they can't see which DNS server your device uses. A tool that claims to show these from a web page is guessing, so we don't show them.
What does the WebRTC leak test check?
WebRTC lets websites find your IP addresses for video calls. The test asks two public STUN servers which address your browser appears from and compares it with the address our server sees. If WebRTC reveals a different public IP, for example your real one while a VPN is on, that's a leak.
Do you store my IP address or results?
The tool keeps a scrambled version of your IP for rate limits and caches your scan result for 10 minutes so repeat clicks don't rescan. Nothing is kept after that. Like every website, our web server may still record visits in its normal logs.
Does this test the firewall on my computer?
Usually it tests your router, because that's what answers at your public IP. Your computer's own firewall only matters here if the router forwards ports to it or you're connected directly to the internet.