Open Terminal

Port Scanner & Firewall Test

Available

Test your router or firewall from the outside, or scan a server you own (verified by a DNS TXT record): open, closed and filtered ports, detected services and risky exposures, powered by Nmap.

What to scan

Target

Scans the public IP address your connection comes from — the outside view of your router or firewall, as anyone on the internet sees it.

Your public IP: checking…

The 100 most common TCP ports (Nmap’s frequency list).

Scan report

Choose a target and start a scan. A scan takes 10–50 seconds.

How it works

The NetTools server runs Nmap with a fixed TCP connect scan against one host: your own public IP address (the outside view of your router or firewall), a domain whose owner published a NetTools verification TXT record, or scanme.nmap.org, which the Nmap project provides for test scans. Open ports accepted a connection, closed ports refused it and filtered ports did not answer because a firewall dropped the packets. Optional service detection identifies the software on open ports.

Reading the results

  • Open: a service accepted the connection — it is reachable from the internet.
  • Closed: the host answered but nothing listens there (connection refused).
  • Filtered: no answer at all — a firewall silently drops the connection. For a home connection this is the ideal result.

Scans use Nmap’s TCP connect scan from the NetTools server, so they show the view from one point on the internet. The verification record is _nettools-verify.<your-domain>.

Safeguards & responsible use

  • Scope is enforced by the server: your own IP, a DNS-verified domain, or the Nmap demo host — never arbitrary targets.
  • One host per scan, fixed port profiles (at most 100 ports), no custom Nmap flags, no shell.
  • At most 6 scans per visitor and 4 per target per hour; every scan is written to an audit log.
  • Private, reserved and internal addresses are refused.

Frequently asked questions

Can I scan any website?

No. Scanning systems without permission may be illegal and is abusive. You can scan your own connection, a domain you prove you control with a DNS TXT record, or the Nmap demo host.

What result is best for a home connection?

All ports filtered: your router drops unsolicited connections and does not even reveal that it exists. Open ports mean something on your network is reachable from the internet — check port forwarding and UPnP on your router.

Why do I see different results from my phone?

Mobile networks usually put many customers behind shared addresses (carrier-grade NAT), so you are testing your provider’s firewall, not your device.

Will custom Nmap flags be supported?

No. Only predefined, non-intrusive profiles are available, and no commands are passed to a shell.