What Is a Port and How Do You Open One?
What is a port? TCP vs UDP, common port numbers, opening ports on Linux and Windows servers, testing whether a port is open and keeping your ports secure.
A port is a number between 0 and 65535 that tells a server which application you want to reach. If an IP address is the address of an apartment building, the port is the apartment number: web traffic arriving at one IP address goes to the web server on port 443, Minecraft players go to the game server on port 25565, and SSH connections go to port 22. Opening a port means telling the firewall to accept connections to that number.
This guide explains what a port is, how TCP and UDP differ, the most common port numbers, how to open ports on Linux and Windows servers and how to test whether a port is open.
How do ports work?
When you connect to a server, you really connect to an IP address and a port number, such as 203.0.113.10:25565. Every application running on a server listens on one or more ports. When a packet arrives, the operating system hands it to the application listening on that port.
For a connection to succeed, three things must be true at once:
- The application is running and listening on the right port.
- The application is listening on the right address.
0.0.0.0means all network interfaces;127.0.0.1means only the server itself. An application listening on127.0.0.1can't be reached from outside. - Every firewall along the way allows the port. That means the firewall inside the server and, if there is one, your provider's or router's firewall.
"Opening a port" is usually thought of as step three only, but most connection problems actually come from the first two.
TCP vs UDP
Every port number exists separately for two protocols: TCP and UDP. 25565/TCP and 25565/UDP are two different ports.
| Feature | TCP | UDP |
|---|---|---|
| Connection | A connection is set up first | Sent without setting up a connection |
| Reliability | Lost packets are resent | Lost packets are not resent |
| Order | Packets arrive in order | Order is not guaranteed |
| Speed | Slightly more overhead | Lighter and faster |
| Typical use | Web, SSH, email, databases | Games, voice calls, DNS, streaming |
Real-time games usually use UDP, because getting the latest position is better than waiting for an old one that arrived late. That's why it matters which protocol an application uses when you open its port. If you're unsure, check its documentation.
Common port numbers
| Port | Protocol | Service |
|---|---|---|
| 22 | TCP | SSH |
| 25, 465, 587 | TCP | SMTP (sending email) |
| 53 | UDP / TCP | DNS |
| 80 | TCP | HTTP |
| 443 | TCP | HTTPS |
| 993 | TCP | IMAP (SSL) |
| 3306 | TCP | MySQL / MariaDB |
| 3389 | TCP | Remote Desktop (RDP) |
| 25565 | TCP | Minecraft Java Edition |
| 19132 | UDP | Minecraft Bedrock Edition |
| 30120 | TCP / UDP | FiveM |
| 27015 | UDP / TCP | CS2, Garry's Mod (Source) |
| 28015 | UDP | Rust |
Ports 0–1023 are well-known ports, and on Linux only root can listen on them. Game servers and applications usually use ports above 1024.
Opening a port on a Linux server
First, check that the application is actually listening:
sudo ss -tulpn
If you see 0.0.0.0:25565 or *:25565 next to the port, the application listens on all interfaces. If you see 127.0.0.1:25565, change the listen address in the application's settings.
Ubuntu and Debian (ufw):
sudo ufw allow 25565/tcp
sudo ufw allow 30120
sudo ufw status
If you don't specify a protocol (30120), the port is opened for both TCP and UDP. If you're enabling ufw for the first time, run sudo ufw allow OpenSSH first, or you'll lock yourself out of SSH.
AlmaLinux and Rocky Linux (firewalld):
sudo firewall-cmd --permanent --add-port=25565/tcp
sudo firewall-cmd --reload
Opening a port only to your own IP address is a good habit for admin ports:
sudo ufw allow from 198.51.100.7 to any port 3306 proto tcp
If you use Docker, be careful: ports published by Docker bypass ufw rules. We cover the details in our guide on how to install Docker.
Opening a port on a Windows server
On Windows Server, open PowerShell as administrator and add an inbound rule:
New-NetFirewallRule -DisplayName "Minecraft" -Direction Inbound -Protocol TCP -LocalPort 25565 -Action Allow
For UDP, add a second rule with -Protocol UDP. You can do the same in the graphical interface under Windows Defender Firewall → Advanced settings → Inbound Rules → New Rule → Port.
To see whether the application is listening on the port:
netstat -ano | findstr :25565
Testing whether a port is open
Test from outside the server, from your own computer; a test run on the server itself bypasses the firewall and is misleading.
Linux and macOS:
nc -zv 203.0.113.10 25565
Windows (PowerShell):
Test-NetConnection 203.0.113.10 -Port 25565
succeeded or TcpTestSucceeded : True means the port is open and the application responds. These tools only test TCP reliably. For UDP ports, the best test is to actually connect with the application, for example by joining the server from the game.
Use the result to narrow down the problem:
- Connection refused: The server is reachable but nothing is listening on that port. Check that the application is running and uses the right port.
- Timed out: Packets are being dropped by a firewall. Check the firewall rules on the server.
Hosting from home: port forwarding
If you run a server on your own computer, you need port forwarding on your router so it passes incoming connections to the right computer on your local network. This approach has serious limits, though:
- CGNAT: Many internet providers don't give customers a public IP address. In that case port forwarding doesn't work from outside at all.
- Changing IP address: Home connections can get a new IP address whenever the router restarts.
- Security and DDoS: Sharing your home IP address means an attack can take down your whole household's internet. We explain this in What is a DDoS attack?
- Upload speed: Home connections usually upload much more slowly than they download.
For a game server, bot or web application that needs to stay online 24/7, a rented server is far less hassle.
Port security
- Open only what you need. Every open port you don't use is a door for attackers. Close everything by default with
ufw default deny incomingand allow only the ports you need. - Don't expose databases. Services such as MySQL, PostgreSQL and Redis should listen on
127.0.0.1only. If you need remote access, open the port to your own IP address only or use an SSH tunnel. - Protect admin ports. Use key-based login for SSH, protect admin ports such as RCON with strong passwords and, where possible, open them to your own IP address only. We cover SSH security in What is SSH?
- Changing a port is not protection on its own. Moving SSH off port 22 reduces automated attempts in your logs, but strong authentication is what actually protects you.
Managing ports on Nodesty servers
On Nodesty virtual servers such as the AMD Ryzen 9 9950X VPS, we don't block game ports or UDP traffic by default; you decide which ports are open with your server's firewall. L3–L7 nShield DDoS protection in front of your server filters attack traffic aimed at your open ports before it reaches you. If you'd rather skip the setup, our game server plans come with Minecraft, FiveM, Rust, Unturned and Garry's Mod ready to go.
Frequently Asked Questions
How many ports are there?
Every IP address has 65,536 TCP ports and 65,536 UDP ports, numbered 0 to 65535. Ports 0–1023 are well-known ports reserved for system services, 1024–49151 are registered by applications, and 49152 and above are used for temporary connections.
Is opening a port safe?
A port only matters if an application is listening on it, and its security depends on that application. Opening the port of an up-to-date game or web server protected by a strong password is normal. Don't expose services like databases and admin panels to everyone.
I opened the port but still can't connect. Why?
The most common causes are that the application isn't running, it only listens on 127.0.0.1, the wrong protocol was opened (TCP instead of UDP or vice versa), or a firewall outside the server is blocking it. Start by checking which address and port the application listens on with ss -tulpn.
I set up port forwarding at home but it doesn't work. Why?
Many internet providers use CGNAT, which means your router doesn't get a public IP address and port forwarding can't work from outside. If the WAN IP shown in your router differs from the one an IP lookup site shows, you are behind CGNAT. The fix is a static IP from your provider or renting a server.
How do I test whether a UDP port is open?
Because UDP is connectionless, an open and a closed UDP port are hard to tell apart reliably from outside. The best test is to actually connect with the application, for example by joining the game server from the game. On the server, ss -ulpn confirms that the application is listening.
Does Nodesty block any ports?
On Nodesty virtual servers we don't block game ports or UDP traffic by default. If you can't connect, check the firewall inside your server and the address your application listens on; if the problem persists, open a support ticket with your IP, port and service.
About the author
Nodesty Team · Infrastructure & Support
The Nodesty team runs our servers, network and DDoS protection day to day and answers customer support requests around the clock. These guides come from that work.
Related articles
How to Upgrade Ubuntu Server to the Next LTS Release
How to upgrade an Ubuntu server to the next LTS release: backups, preparation, do-release-upgrade, SSH access, post-upgrade checks and a clean install.
What Is a Load Balancer and How Does It Work?
What is a load balancer and what does it do? Balancing methods, health checks, session handling, load balancing with Nginx, HAProxy and when you need one.
How to Deploy a Laravel App to a VPS
How to deploy Laravel to a server: PHP-FPM, Composer, .env, the database, file permissions, Nginx, queue workers, the scheduler, SSL and shipping updates.