Checking which ports are open, and which should not be

What a port check tells you, the services that must never face the internet, and how to close them properly.

A port check connects to a handful of named TCP ports from outside and reports which ones answer. It is a quick way to confirm that a service is reachable, and a quicker way to find services that were never meant to be.

Reading the result

Open means the server completed the TCP handshake, and often sent a banner naming the software (SSH, SMTP and FTP servers usually do). Closed means the connection was refused or timed out, which from outside looks the same whether the service is stopped or a firewall is dropping packets. The check names up to twenty ports and runs from a single address in London; it is not a scan of every port, and it says nothing about UDP.

What is normal

Web servers answer on 80 and 443. Mail servers answer on 25 (server to server), 465 and 587 (client submission), and 110, 143, 993 and 995 for collecting mail. SSH on 22 is normal for a server you administer, provided it uses key authentication and rate limiting. Control panels often sit on 2083, 2087, 2222 or 8443 and are better restricted to known addresses.

What should never face the internet

Database servers (MySQL 3306, PostgreSQL 5432, MS SQL 1433, MongoDB 27017), caches (Redis 6379, Memcached 11211), search clusters (Elasticsearch 9200) and remote-desktop protocols (RDP 3389, VNC 5900) are designed for trusted networks. Several accept connections without any password by default; all are brute-forced within hours of appearing. Memcached in particular is abused for amplification attacks against third parties. Telnet (23) sends everything in clear text and has no place on a modern server.

Closing a port properly

Two layers: bind the service to localhost or a private interface so it cannot listen on the public address at all, and firewall the port so that even a misconfigured service stays unreachable. On Linux that is bind-address or listen directives in the service's configuration, plus a firewall rule (CSF, ufw, nftables or the provider's security groups). Then re-run the check from outside; a port that is closed from the server's own shell is not necessarily closed from the internet.

Etiquette

Checking ports on hosts you do not operate is a grey area. whois.me.uk limits the check to the ports you name, at most twenty, from a published address, and reserves full-range scanning for verified owners.