- Tri-State Classification: A port is OPEN when a daemon responds with SYN-ACK, CLOSED when the host is reached but the software is offline (TCP RST), and FILTERED when a firewall, ISP CGNAT, or defender drops packets with zero response (Timeout).
- The Hairpin NAT Caveat: Testing your external IP from inside your own Wi-Fi/LAN frequently fails if your router lacks NAT Loopback (Hairpinning). Always test via an external vantage point.
- 100% Client-Side Privacy: Router Portal executes automated STUN discovery and zero-ad socket testing without retaining logs, storing IP history, or injecting tracking scripts.
🛡️ 1-Click Automated Host Firewall Rule Generator
Port showing Closed or Filtered? Permit inbound traffic through the target machine's operating system defender.
Tri-State Socket Diagnostics: What Your Result Really Means
Unlike legacy utilities that reduce all failed probes to a vague "Port Closed" error, professional network engineering relies on RFC 793 Transmission Control Protocol state machines to pinpoint the exact failure boundary:
| Tri-State Status | Wire Protocol Signature | Physical Network Meaning | Actionable Remediation Step |
|---|---|---|---|
| 🟢 OPEN | SYN-ACK returned within RTT |
Packet traversed WAN, router NAT translated destination to local host, and daemon accepted handshake. | Rule is verified operational. Restrict external source IP addresses if exposing sensitive protocols. |
| 🔴 CLOSED | RST (Reset) flag returned |
Router port forwarding rule succeeded! Remote host was reached, but no software listener is running on that port. | Launch your game/server application. Verify daemon is bound to 0.0.0.0 (all interfaces), not 127.0.0.1. |
| 🟡 FILTERED / STEALTH | Zero response (Timeout > 2500ms) | Inbound SYN packet dropped in transit. Router firewall, OS defender, or ISP CGNAT silently discarded packet. |
Check Windows Defender / UFW rules using the CLI generator above. Verify your router WAN IP does not fall in RFC 6598 CGNAT. |
| ⚪ UDP INCONCLUSIVE | No 3-way handshake (RFC 768) | UDP is connectionless. Daemons remain silent unless valid cryptographic or game payload is supplied. | Test direct connection from native client (e.g. Minecraft Bedrock, WireGuard client handshake). |
The 5-Layer Troubleshooting Hierarchy: Why Ports Fail to Open
When an open port test fails, methodical network engineers isolate the problem across five distinct architectural layers rather than performing destructive factory resets:
- Layer 1: Application Listener State: Confirm the software (e.g. Minecraft server, Plex, Docker container) is running before testing. Run
netstat -ano | findstr :<PORT>(Windows) orsudo ss -tulpn | grep :<PORT>(Linux) to ensure the daemon is listening on0.0.0.0rather than localhost. - Layer 2: Local Host Firewall Rules: Windows Defender Firewall, macOS Application Firewall, and Linux UFW actively block unsolicited external connections by default even if the router forwards the packet. Run the automated 1-click CLI commands generated above.
- Layer 3: Router DHCP Reservation (Static LAN IP): Ensure your server host holds a permanently reserved RFC 1918 private IP address (e.g.,
192.168.1.150). If the router DHCP server assigns a new IP upon reboot, all port forwarding rules point to an empty host. - Layer 4: NAT Virtual Server Rule Configuration: Verify that the external WAN port matches the internal service port, and that the protocol (TCP, UDP, or BOTH) matches the exact application requirement.
- Layer 5: Upstream ISP Carrier-Grade NAT (CGNAT) & WAN IP Audit: Compare your router's WAN IP shown in its web GUI status page with the public IP shown by this tool. If your router WAN IP begins with
100.64.0.0through100.127.255.255(RFC 6598), you are trapped behind ISP CGNAT and cannot open ports without an IPv6 tunnel, Cloudflare Tunnel, or Tailscale DERP relay.
Frequently Asked Questions
Top 12 Most Forwarded Application & Game Server Sockets
| Application / Server | Default Port(s) | Protocol | Transport Purpose | NAT Forwarding Requirement |
|---|---|---|---|---|
| Minecraft (Java Edition) | 25565 | TCP | Standard dedicated player connections | Inbound port forward required on primary router. |
| Minecraft (Bedrock / Mobile) | 19132, 19133 | UDP | Cross-platform multiplayer query & game data | Inbound UDP forwarding required. |
| Steam / Source Engine (CS2) | 27015 | UDP / TCP | Source multiplayer game server coordination | Forward UDP 27015; TCP optional for RCON. |
| Call of Duty: Warzone / MW3 | 3074 | UDP / TCP | Demonware handshake for Open NAT matchmaking | Forward 3074 UDP to eliminate Strict/Moderate NAT. |
| FiveM (GTA V Dedicated) | 30120 | UDP / TCP | FXServer client sync and HTTP asset downloads | Forward both TCP and UDP on port 30120. |
| Rust Dedicated Server | 28015, 28016 | UDP / TCP | Player traffic (UDP) and RCON admin (TCP) | Forward UDP 28015 and TCP 28016. |
| Palworld Dedicated Server | 8211 | UDP | Unreal Engine 5 co-op survival multiplayer | Forward UDP 8211. |
| Plex Media Server | 32400 | TCP | Remote video streaming outside home LAN | Forward TCP 32400; verify remote access in settings. |
| Jellyfin / Emby Media | 8096 | TCP | Self-hosted media streaming web interface | Forward TCP 8096 (or 8920 HTTPS). |
| Home Assistant | 8123 | TCP | Smart home dashboard external access | Forward TCP 8123 (Prefer Tailscale or Cloudflare Tunnel). |
| WireGuard VPN Endpoint | 51820 | UDP | Encrypted tunnel gateway handshake | Forward UDP 51820 to host endpoint. |
| OpenVPN Gateway | 1194 | UDP | SSL/TLS encrypted VPN client tunnel | Forward UDP 1194. |
Why does the port checker say closed when my game server is running?
A "Closed" (TCP RST) result indicates that the packet successfully reached your computer, but your operating system actively refused the connection. The two most common causes are: (1) The game server is bound strictly to localhost (127.0.0.1) instead of all network adapters (0.0.0.0), or (2) Your local OS firewall permits local subnet connections but rejects public WAN packets.
What is Carrier-Grade NAT (CGNAT) and why does it block port forwarding?
Due to global IPv4 address exhaustion, internet service providers (especially Starlink, T-Mobile 5G Home Internet, mobile carriers, and fiber ISPs) assign a single shared public IPv4 address to hundreds of residential subscribers simultaneously using RFC 6598 (100.64.0.0/10). Because the public IP is shared at the ISP datacenter level, inbound connection requests cannot be mapped to your specific router without a static public IP addon or IPv6 routing.
Is it safe to keep ports open permanently?
Only open ports required for active services and never expose administrative services like Windows RDP (3389), Telnet (23), or unauthenticated databases (MySQL 3306, Redis 6379) directly to the WAN. For remote server administration, always utilize a modern cryptographic VPN such as WireGuard or an SSH tunnel protected by public-key cryptography and Fail2ban rate-limiting.
Why can my friends outside connect, but I cannot connect using my public IP from home?
This is known as the "NAT Loopback" or "Hairpin NAT" issue. When a device inside your home network requests its own external public IP address, consumer routers without NAT hairpinning support do not know how to loop the packet back across the LAN bridge. Always test local connections using your machine's private LAN IP (e.g. 192.168.1.50) and reserve public IP testing for external peers or diagnostic tools.
Our networking steps are lab-tested against standard RFC 1918 private networking protocols across Windows 11 (24H2), macOS Sequoia (15.1), iOS 18, and Android 15. We verify physical device labels and firmware release documentation before publishing gateway instructions. Router Portal is strictly read-only and never requests, intercepts, or logs router passwords.