Lesson 4 of 720 minutesHands-on

What’s open to the internet?

Automated scanners probe every address on the internet all day, looking for anything that answers. In this lesson you’ll look at your own connection the way they do, from the outside, then find and close anything that’s open without a good reason. On most home networks the answer is “nothing”, and by the end you’ll know for sure whether yours is one of them.

In this lesson

  • Understand why most home networks are closed from the outside by default
  • Scan your own connection and read the results
  • Review port forwarding, UPnP and the DMZ setting in your router

You’ll need: a device on your home network with any VPN switched off, and your router’s admin page.

Why your network is closed by default

All the devices in your home share one public address on the internet, your router’s. When your laptop asks a website for a page, the router remembers the request and passes the reply back to the laptop. When something on the internet sends a connection your devices never asked for, the router has nowhere to send it, so it drops it. This is called NAT, and it’s the main reason strangers can’t reach your laptop directly. What Is a NAT Firewall? explains it in depth.

Three things deliberately make holes in that protection:

  • Port forwarding: a rule you or someone else created, telling the router to send anything arriving on a certain port to one device.
  • UPnP: a feature that lets devices and apps create those rules themselves, automatically, without asking you. Games consoles and some smart devices use it.
  • DMZ: a setting that forwards everything to one device, removing its protection completely.

Try it yourself · part 1

Scan your own connection

  1. Switch off any VPN first. The scanner checks the address your browser connects from, so with a VPN on it would scan the VPN’s server, not your home.
  2. Open the Port Scanner. It shows the address it’s about to scan. It can only ever scan the address you’re visiting from, so it can’t be pointed at anyone else’s network.
  3. Choose Common and click Scan my ports. Then try Remote access and Windows, which cover the ports attackers look for most.
  4. Read the verdict at the top:
    • All closed: Nothing reachable. None of the ports checked accepted a connection. That’s the result you want.
    • Check these. Some ports are open. Fine if you set them up deliberately, worth tracing if not.
    • Action needed. A high-risk port is open to the whole internet. Find out why today.
  5. In the table, each port is filtered (no reply at all, the best result), closed (your connection replied that nothing is there, also fine) or open (something answered).
Using IPv6? If the scanner shows a long address with colons, your browser connected over IPv6. There’s no NAT on IPv6: each device has its own address, and your router’s firewall is what blocks unwanted connections. The scan then tests your device directly, which is a useful check that the router’s IPv6 firewall is on.

Ports worth worrying about

PortWhat it isIf it’s open
23Telnet, an old login with no encryptionShould never face the internet. Close it
3389Windows Remote DesktopHeavily attacked. Close it, or use a VPN to reach it instead
445Windows file sharingShould never be open from outside. Close it
22SSH, a secure remote loginOnly if you set it up on purpose, with key-based login
80, 443, 8080Web serversExpected only if you run a website, camera or server at home on purpose

Try it yourself · part 2

Find out why a port is open, and close it

  1. In the router’s admin page, open Port forwarding (sometimes Virtual servers, NAT or Applications). Delete any rule you don’t recognise or no longer need.
  2. Find DMZ and make sure it’s off, unless you know exactly why it’s on.
  3. Find UPnP. Many routers list the rules UPnP has created; check what’s there. Then turn UPnP off and see whether anything you use stops working.
  4. If a games console then reports a stricter “NAT type” and you play online a lot, you can open just the ports it needs yourself with a port forwarding rule: a deliberate, visible rule instead of an automatic one.
  5. Run the scan again. Every port you closed should now be filtered or closed.
Can’t open anything even if you try? Some providers share one public address between many customers, called CGNAT. Nothing from outside can reach you at all, so the scan will show nothing open. That’s safe, though it also means port forwarding won’t work. What Is CGNAT? explains how to tell, and what to do if you need it.

Key takeaways

  • NAT keeps unrequested connections out by default; port forwarding, UPnP and the DMZ make holes in it.
  • Scan with any VPN off, so you test your home and not the VPN.
  • Filtered and closed are both good; open means something answered and you should know what.
  • Ports 23, 3389 and 445 should never be open to the internet.
  • On IPv6 there’s no NAT: the router’s firewall is what protects each device.

Check yourself

Three questions. Pick one answer each and you’ll see why.

1. You run the port scan with your VPN switched on. What have you tested?

2. The scan shows port 3389 open, and you don’t remember setting anything up. What’s the likely cause?

3. What does the DMZ setting do?

Want to check open ports from inside your network too? How to Check Open Ports covers the commands, and What Is Port Forwarding? explains the rules you just reviewed.

This lesson is part of the free course Secure Your Home Network, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.

Scroll to Top