External Port Check

Input

• Port: the TCP port on your public IP to test (1–65535). Set up port forwarding on your router for this port first.
• No host is entered — your public IP is detected server-side, so the check always targets you.

How it works

• A device can't prove this about itself: connecting to your own public IP from inside the LAN hits NAT loopback or fails.
• The app calls a NetDebug helper server on the internet, which attempts a TCP handshake back to your-public-ip:port.
• Because the connection originates outside your network, the result reflects real inbound reachability. The server only ever connects back to your own IP — it is not a general port scanner.

Output

• Open — the handshake succeeded; the internet can reach the port. Port forwarding and firewall are working.
• Closed — your IP is reachable but nothing is listening (connection refused). The port is not forwarded to a running service.
• Filtered — no response before timeout. Inbound traffic is being dropped: no port forward, a firewall, or carrier-grade NAT (CGNAT).
• Your public IP, the tested port, and connect time in milliseconds.

Tips

• Start the service you are forwarding before testing — a forward to a stopped service reads as Closed.
• Filtered on every port often means carrier-grade NAT: your ISP shares one public IP across many customers, so inbound forwarding is impossible without a static IP or IPv6.
• Pair with UPnP / NAT-PMP to check whether your router can create the forward automatically, and with Port Scan to see what is open on a host from the inside.

Deeplink

netdebug://reachme?port=8080

Tip: in the app, open the Export menu (the share icon) on this screen and choose Copy Deeplink to copy this link as a Universal Link with your current port already filled in.