What open, closed and filtered mean
- Open: a program is listening and accepted the connection. Anyone on the internet can reach it.
- Closed: the server answered straight away that nothing listens on that port. The machine is reachable, but the port is not in use.
- Filtered: no answer at all before the timeout. A firewall (UFW, iptables, your cloud provider's firewall or security group) is silently dropping the traffic. For ports you don't use, this is what you want to see.
Why check for exposed databases?
Databases, caches and admin APIs should only listen on 127.0.0.1 or a private network. The most common way they end up on the internet is a Docker port mapping like -p 3306:3306: Docker writes its own firewall rules, so the port is open even when UFW says it is blocked. Bots scan the whole internet for open Redis, MongoDB, Elasticsearch and Docker APIs within hours, and an open Redis or Docker API is enough to take over the server.
If something shows as open that shouldn't be, bind it to localhost (-p 127.0.0.1:3306:3306 in Docker, bind-address = 127.0.0.1 for MySQL, bind 127.0.0.1 for Redis), or block it in your provider's firewall, which sits in front of Docker.
Testing a firewall rule
Change one rule at a time and check the port from here after each change. Keep your SSH session open while you test, so a mistake doesn't lock you out.
Privacy and limits
The check runs from Cloudhim’s server: it opens a TCP connection to each port, reads the greeting if the service sends one first (SSH, SMTP, FTP, MySQL), and closes the connection without sending anything. IPv6-only hosts can't be checked from here. To keep the tool from being used to scan other people's servers, multi-port checks are limited to a few per visitor and per server every ten minutes. Only check servers you own or manage.