Port Scanner & Firewall Test – Complete Guide to Scanning Your Own Exposure with Nmap

Every device on the internet is scanned constantly by automated tools looking for open databases, remote desktops and outdated software. The useful question for you is what those scanners see when they look at your router or server. A port scan from outside answers it: which ports accept connections, which refuse them, and which are silently dropped by a firewall.

The NetTools.tech Port Scanner & Firewall Test runs Nmap from our server against targets you are entitled to scan: your own public IP address, a server whose domain you have verified via DNS, or the official Nmap demo host. It reports the state of each port, detected services and versions, and highlights services that should rarely be exposed.

What is a port scanner?

In simple terms

A port scanner tries to connect to many ports on one machine and records the answer for each: accepted, refused or no answer. The result is a map of which services are reachable from where the scan runs. A firewall test is the same thing pointed at your own internet connection, to confirm that your router does not expose anything by accident.

Technical background

Nmap is the standard open-source port scanner. Its classification of port states is used throughout the industry:

• open — an application accepted the connection (the TCP handshake completed).
• closed — the host answered with a reset (RST): reachable, but nothing listens.
• filtered — no answer, or an ICMP unreachable error: a firewall or filter blocks the probe, so Nmap cannot tell whether the port is open.
• Combined states such as open|filtered or closed|filtered appear when Nmap cannot decide between two states.

Nmap supports several scan techniques. A TCP connect scan (-sT) uses the operating system's normal connect() call, completing a full TCP handshake on open ports and then closing it. It needs no raw sockets and is the least unusual traffic for the target. Service detection (-sV) then sends protocol probes to open ports and matches the answers against Nmap's database to identify the software and often its version; --version-light restricts this to the most likely probes.

Nmap also maintains a frequency table of how often each port is found open on the internet, which is what --top-ports N uses to pick the N most common ports.

Why use a port scanner?

• Test your firewall from outside. Confirm that your home or office router drops unsolicited connections and that no port forwarding or UPnP rule exposes a device.
• Audit a server. List every reachable service on a server you run and compare it with what should be public.
• Catch risky exposures. Databases, RDP, SMB, Redis, Docker APIs and similar services are frequent breach causes when reachable from the internet.
• Verify changes. Rerun after closing a port or changing a security group.
• Check version disclosure. Service detection shows which software versions your services announce.

Who should use it?

• System administrators and DevOps engineers checking servers they operate.
• Security teams doing a quick external exposure check on assets they are responsible for.
• Home and small-business users testing their router after setting up port forwarding, cameras, NAS devices or game servers.
• Managed service providers verifying a customer's perimeter with the customer's DNS-based consent.

How the port scanner works

Scope is enforced on the NetTools server, never only in the browser. There are three target modes:

1. Test my firewall (your own IP). The server scans the public IPv4 address that the request came from — the outside view of your router, firewall or provider's NAT. You cannot type in an address. If you are connected over IPv6, or the address the server sees is not a public internet address, the scan is refused.
2. Scan my server (verified domain). You request a verification record for your domain. The server generates a token (an HMAC of the domain and the current week, so no account or stored state is needed) and shows a TXT record to publish at _nettools-verify.<domain> with the value nettools-verify=<token>. When you start the scan, the server looks up that TXT record through public resolvers (1.1.1.1 and 8.8.8.8) and accepts tokens of the current and the previous week, which gives a validity of 7 to 14 days. Only then is the domain resolved and its IPv4 address scanned. Domains that resolve to private or reserved addresses, and IPv6-only domains, are refused. You must also confirm that you own the server or have written permission to test it.
3. Demo target. scanme.nmap.org, a host the Nmap project provides so people can try scanning legally.

The scan itself:

• Fixed command, no shell. Nmap runs by absolute path with a fixed argument array:

nmap -sT -Pn -n --max-retries 1 --host-timeout 45s -T4 -sV --version-light --top-ports 100 -oX - -- 203.0.113.10

That is a TCP connect scan, no host discovery ping (-Pn), no DNS resolution, one retry, a 45-second host timeout and timing template T4. -sV --version-light is included only when service detection is enabled, and --top-ports is replaced by an explicit -p list for profiles with fixed ports. The process has a hard limit of 55 seconds.

• Fixed profiles. One host per scan, at most 100 ports:

• Limits. At most 6 scans per visitor and 4 per target address per hour, 6 per hour for the demo host in total, and at most 2 scans running on the server at once.
• Audit log. Every scan is logged with mode, target, profile and time; for your own IP and for the requesting client only a truncated address (the /24 network) is logged.
• Analysis. Nmap's XML output is parsed into ports, states, reasons and services, and the page applies a fixed list of risky services to produce findings.

How to use the NetTools.tech port scanner

1. Open the Port Scanner & Firewall Test.
2. Under Target, choose Test my firewall, Scan my server or Demo target.
   • Test my firewall shows the public IP that will be scanned.
   • Scan my server: enter Your domain, select Get verification record, copy the Name and Value, publish the TXT record at your DNS provider and wait a few minutes. Tick I own this server or have written permission to test it.
3. Choose Ports, one of the profiles above. The hint under the field describes it.
4. Leave Detect services and versions on to identify software on open ports, or turn it off for a faster, quieter scan.
5. Select Start scan. A scan takes about 10 to 50 seconds.
6. Read the Scan report, and export with CSV, JSON, Copy all or Print. After a server scan, remove the verification TXT record.

For a single port on any public host, the Port Check is the right tool instead.

Understanding the results

Findings use a fixed list of services that should rarely face the internet. For example Telnet (23), SMB (445), RDP (3389), MySQL/MariaDB (3306), PostgreSQL (5432), Redis (6379), Elasticsearch (9200), Memcached (11211), MongoDB (27017) and the unencrypted Docker API (2375) are high severity; FTP (21), RPC portmapper (111), WinRM and Webmin are medium; plain POP3 and IMAP are low; SMTP 25 is informational because mail servers need it. An open port that reveals product and version through service detection adds a low-severity note. When no port is open, or all ports are filtered, informational findings say so; if closed ports answer with refusals instead of being dropped, a note mentions that a dropping firewall reveals less.

If Nmap reports the host as down or the scan hit its time limit, the report says so and the results are partial.

Example: a home router with a forgotten forward

A user runs Test my firewall with the Common services (top 100) profile and service detection on. Values are illustrative.

• Open: 2, Closed: 0, Filtered: 98, High-risk open: 1

Findings:

• High — Port 3389 (RDP) is open to the internet. A top target for brute force and exploits; put it behind a VPN or gateway.

Port 443 belongs to the NAS web interface the user intended to publish. Port 3389 is a forgotten forwarding rule for a desktop PC. The fix is to remove that rule in the router (and check that UPnP did not create it), then rescan: the expected result is 99 filtered ports and one open.

Common use cases

• Checking a home or office connection from outside after router changes.
• Auditing a new VPS or cloud server before putting it into production.
• Verifying that databases and caches are not reachable from the internet.
• Confirming that a security group or firewall change took effect.
• Learning how scan results look using the Nmap demo host.

Troubleshooting

"You are connected over IPv6"

The scanner has no IPv6 connectivity yet. If your network is dual-stack, the browser chose IPv6 for the request. Test from an IPv4-only network or device, or scan your server through a verified domain with an A record.

"Ownership is not verified"

The TXT record at _nettools-verify.<domain> was not found with a valid token. Check that the record name is exactly as shown (some DNS panels append the zone automatically, producing _nettools-verify.example.com.example.com), that the value matches including the nettools-verify= prefix, and wait for DNS propagation. DNS Lookup shows whether the TXT record is visible.

"Your connection comes from … which is not a public internet address"

The address the server sees is not public, so there is nothing to scan from outside. This can happen with unusual proxy setups.

Everything is filtered on a server that runs services

A cloud security group or firewall may allow connections only from specific addresses, or the host is down. Nmap with -Pn scans anyway, so "filtered everywhere" plus "host down" in the report points at the host or its upstream filter.

"Scan limit reached" or "This address has been scanned several times"

The per-visitor limit (6 per hour) or per-target limit (4 per hour) is reached. Wait an hour, or use the smaller profiles to focus on what you need.

Results from a phone differ from home

Mobile carriers usually use carrier-grade NAT, so you scanned the provider's shared gateway. That says nothing about your phone's own ports.

Common mistakes

• Trying to scan third-party sites. The scope rules prevent it, and scanning without permission can be illegal.
• Forgetting to remove the verification record. Delete the TXT record after your scans.
• Treating "guessed from port number" as fact. Without a probe match, the service name only reflects the port's usual use.
• Assuming the scan covers all 65,535 ports. Profiles cover at most 100 TCP ports.
• Reading one scan from Latvia as the whole internet's view. Firewalls that filter by source country or address behave differently for other sources.

Limitations

• Only your own public IPv4 address, a DNS-verified domain's IPv4 address or the Nmap demo host can be scanned.
• TCP connect scans only; no UDP, no IPv6, no custom flags or port lists.
• At most 100 ports per scan from fixed profiles, so services on unusual ports can be missed.
• A domain scan tests one IPv4 address of the domain; other addresses behind DNS round-robin or a CDN are not covered.
• Scans run from one location, the NetTools.tech server in Latvia, with a 45-second host timeout.
• Service detection is light and can misidentify or fail to identify software; it is not a vulnerability scan.
• The risk list is a fixed set of well-known services, not an assessment of your specific configuration.

Security & privacy

• What is processed: the scan mode, the domain you enter (for server scans), the chosen profile and your connection's IP address, which is needed to scan your own IP and to enforce limits.
• Audit log: every scan is logged on the server; your own IP is stored only truncated to its /24 network.
• Verification: the TXT token proves control of the domain without an account. The token alone grants nothing beyond scans of that domain for one to two weeks.
• Scope and limits: enforced on the server; private, reserved and internal addresses are refused; no shell and no user-supplied Nmap options.
• What not to enter: nothing sensitive is required. Only verify and scan domains you control or have written permission to test.

Related tools

• Port Check — one TCP port on any public host. Guide: port check guide.
• What Is My IP — shows the public IP a firewall test will scan. Guide: what is my IP guide.
• SSL Certificate Checker — checks TLS on open HTTPS and mail ports. Guide: SSL checker guide.
• Open DNS Resolver Check — tests whether a DNS server answers recursive queries for anyone. Guide: open resolver guide.
• Website Security Assessment — non-intrusive web security checks. Guide: security assessment guide.
• Category overviews: Network diagnostics guide, security testing guide.

Summary

The NetTools.tech port scanner runs a fixed Nmap TCP connect scan of up to 100 ports against one host you are entitled to test: your own public IP, a domain verified with a _nettools-verify TXT record, or scanme.nmap.org. It reports open, closed and filtered ports, identifies services on request and flags risky exposures. For a home connection, all filtered is the goal; on a server, every open port should be one you intend to publish.