What a port actually is
Your public IP address gets traffic to your router, but an address alone isn't enough — one connection might be a video call, another a game, another a file download, all arriving at the same IP at the same time. Ports are how that traffic gets sorted. Every TCP or UDP packet carries a port number from 0 to 65535, and each number acts like a numbered door on the same building: web servers traditionally answer on door 443 (HTTPS), mail servers on 25, remote desktops on 3389.
A port is called open when some piece of software is listening behind that door and will answer a connection attempt. It's closed when the device actively replies "nothing here," and filtered when a firewall silently drops the attempt so the caller learns nothing at all. Open isn't inherently bad — nothing would work without open ports somewhere — but every open port on your public IP is a service exposed to the entire internet, and its security is only as good as the software answering the door.
Why strangers are knocking in the first place
Port scanning is how the internet takes inventory of itself. Search engines like Shodan and Censys scan the whole IPv4 space continuously and publish what they find. Botnets do the same thing with worse intentions: compromised machines sweep address ranges around the clock looking for a familiar open port, then try default passwords or known exploits against whatever answers. None of it is personal — your router isn't targeted because of who you are, it's probed because it has an IP address, the same as every other address in the block.
This is why "I'm not interesting enough to hack" misses the point. Automated scanners don't know or care who you are. A router with an exposed admin panel is worth the same to a botnet whether it belongs to a bank or a student flat: it's bandwidth, a residential IP to proxy traffic through, and a foothold inside a home network. If you want to see what your connection already reveals before any ports come into it, check what websites see about you — the port question is the layer below that.
The ports attackers actually target
All ports are equal in theory; in practice a handful account for the overwhelming majority of attack traffic. If any of these answer on your public IP and you didn't deliberately put them there, treat it as a problem to fix today.
3389 — Remote Desktop (RDP)
The single most attacked port on the internet, year after year. Exposed RDP is the classic ransomware entry point: scanners find the open port, brute-force or buy credentials, log in like a legitimate user, and encrypt everything they can reach. RDP was designed for use inside trusted networks. If you need remote access to a machine at home, put it behind a VPN — never forward 3389 to the open internet.
23 — Telnet
A remote-login protocol from the 1970s that sends everything, including passwords, unencrypted. No modern setup needs it, yet it still ships enabled on some cheap routers, cameras, and smart devices — which is exactly why Mirai-style botnets scan for it constantly, logging in with factory-default credentials. An open 23 on a home connection almost always means a forgotten IoT device waiting to be conscripted.
445 — SMB (Windows file sharing)
The port behind WannaCry and NotPetya. SMB is fine for sharing files inside a LAN and catastrophic when reachable from the internet, because vulnerabilities in it tend to be wormable — one infected machine can find and infect the next with no human involved. Nothing on a home connection should ever expose 445 externally.
21 — FTP and 5900 — VNC
Two more pre-encryption-era protocols that still turn up. FTP transmits credentials in the clear; VNC remote-desktop servers are frequently left with weak or no passwords and get harvested in bulk. Both have modern replacements (SFTP, VPN-tunnelled access) that shouldn't require an open inbound port at all.
22 — SSH
The nuanced one. SSH itself is well-engineered and safe to expose if it's configured properly — key-based login only, passwords disabled. But an SSH port that accepts passwords will collect brute-force attempts within minutes of appearing online, so unless you run it deliberately and know it's keys-only, it shouldn't be open.
1900 — UPnP and 7547 — TR-069
Router-specific troublemakers. UPnP lets devices inside your network open inbound ports on the router automatically, no questions asked — convenient for game consoles, and equally convenient for malware that wants to punch a hole from the inside. TR-069 (port 7547) is the remote-management channel your ISP uses to configure the router; when it's buggy or exposed beyond the ISP's own network, it's been used to hijack routers by the hundreds of thousands. Neither should ever be visible from a stranger's vantage point on the internet.
3306, 1433, 6379 — databases
MySQL, SQL Server, and Redis. These appear on home IPs more often than you'd think — usually a developer's test setup or a NAS app bound to the wrong interface. Internet-exposed databases get found and raided within hours; automated scripts dump the contents and leave a ransom note in their place. Databases belong behind a firewall, full stop.
Why your router probably shields you — and when it doesn't
The reassuring part: a typical home router doing NAT acts as an accidental firewall. Devices inside share one public IP, and an unsolicited connection arriving from outside has nowhere to go unless a forwarding rule explicitly sends it somewhere. Scan a healthy home connection and the common result is that everything comes back closed or filtered.
The gaps in that shield are almost always self-inflicted or vendor-inflicted: a port-forwarding rule you set up for a game or camera years ago and forgot, UPnP silently opening ports on a device's behalf, "remote management" of the router itself left enabled on the WAN side, or ISP equipment listening on 7547. And if your ISP uses carrier-grade NAT, there's an extra wrinkle: your traffic shares a public IP with many other customers, which blocks inbound connections entirely — port forwarding won't work, but by the same token the scanning question applies to the carrier's equipment rather than yours. Our CGNAT explainer covers how to tell which situation you're in.
How to check your own ports
The check that matters is from the outside — the internet's view of your public IP, which is the only view attackers get. Tools that run on your own machine, like netstat, show which programs are listening locally, but they can't tell you what actually gets through your router. The two views answer different questions, and it's the external one that determines your exposure.
Run the GoIPScan port checker from any device on your home connection and it scans your public IP for the risky ports listed above, from the same vantage point a stranger would use. Interpreting the result is simple: filtered or closed everywhere is the healthy answer for a home connection. Anything open should map to something you deliberately run and can name. An open port you can't explain is the finding — that's a listening service you didn't know you were exposing.
One caveat in the other direction: scan while connected to a VPN and you'll be scanning the VPN server's IP, not your router. Disconnect first, or you'll get a clean bill of health for the wrong machine. (And if you use a VPN for privacy, it's worth separately confirming it isn't leaking your real IP.)
Closing the doors you don't need
If a scan turns up something open, the fix usually lives in the router's admin panel. Delete port-forwarding rules you no longer use — each one is a permanent hole aimed at a specific device. Turn off UPnP unless something you actively use breaks without it; consoles increasingly cope fine. Disable remote management from WAN so the router's own login page isn't reachable from the internet, and update the firmware while you're in there, since router bugs are patched far more often than routers are. For anything you genuinely need to reach from outside — a NAS, a desktop, a camera — a VPN into your home network beats a forwarded port in every respect: one hardened, encrypted entry point instead of a scattering of exposed services.
Then re-scan and confirm the change took. Exposure isn't a one-time question — a new device, a helpful app enabling UPnP, or a firmware reset can quietly reopen a door, so it's worth re-checking whenever your network changes. For the broader routine (passwords, updates, phishing, Wi-Fi), our staying safe online checklist picks up where the port scan leaves off.
Frequently Asked Questions
Are open ports always dangerous?
No — an open port is only as dangerous as the service behind it. Port 443 open on a web server is the internet working as designed. The risk comes from services that were never meant to face the internet (RDP, SMB, Telnet, databases), from software with known vulnerabilities, and from anything protected only by a weak or default password. The practical rule for a home connection: every open port should be something you can name and chose to expose.
Is port scanning illegal?
Scanning your own IP address is unambiguously fine, and that's what the GoIPScan checker does — you point it at the connection you're using. The legal picture for scanning other people's systems varies by country and by intent, and unauthorised scanning is against most ISPs' terms of service, so the simple guidance is: test what you own, and get written permission for anything else.
Does a VPN hide my open ports?
While the VPN is connected, inbound scans hit the VPN provider's server instead of your router, so your ports are effectively invisible. But the moment you disconnect, your router is back on the front line — a VPN masks exposure rather than fixing it. Close the ports properly and the VPN becomes a privacy layer instead of a bandage.
What's the difference between an open port and a forwarded port?
Forwarding is one way a port becomes open. A forwarding rule tells your router to pass outside traffic on a given port to a specific device inside; the port then shows as open because that device answers. Ports can also be open because the router itself listens (admin panel, TR-069) or because UPnP created a rule automatically — which is why an external scan sometimes finds doors you never knowingly opened.
My scan shows everything closed or filtered. Am I safe?
From inbound attacks on those ports, yes — that's the result you want, and it means opportunistic scanners will move on. It doesn't cover the other directions trouble arrives from: phishing, malicious downloads, compromised devices dialling out, or a VPN leaking your identity. Think of a clean port scan as one solid wall of the house, not the whole house.
See your connection the way attackers do
Scan your public IP for the risky ports covered in this guide — RDP, Telnet, SMB, and the rest — from the outside, in seconds. If everything comes back closed or filtered, you're ahead of the botnets.