Networking
How to test whether a port is open on your camera system
Whether you just set up a port forward or want to confirm nothing is exposed, the test has to come from outside your network. Here is how to do it properly and how to read the result.
VuePoint
There are two reasons to test a port: you forwarded one and it is not working, or you want to be sure nothing on your camera system is reachable from the internet. Both need the same thing, a test from outside your network aimed at your public IP address.
Basic test
- 1
Find your public IP
Visit any 'what is my IP' site from a computer on the camera network, or read the router's WAN/Internet address. If the two differ, or the router's WAN address starts with 10., 192.168., 172.16-31. or 100.64-100.127, you are behind another NAT layer and inbound connections will not reach you. Stop here and see the CGNAT note below.
- 2
Know which port and protocol to test
Read the current port values on the recorder (see the default ports table in how to set up port forwarding). Most online checkers test TCP only; UDP ports cannot be reliably checked this way.
- 3
Run an external port check
Use an online open-port checker (Amcrest's own guide uses canyouseeme.org). Enter the port; most tools test the IP you are browsing from, so run it from a computer on the camera network. 'Open' or 'success' means something answered on that port from the internet.
- 4
Confirm with the real app on cellular
Turn Wi-Fi off on a phone and connect with the camera app using your public IP or DDNS hostname and the forwarded port. This tests the full path, including the app's protocol, not just whether the port answers.
Command-line tests (from a machine outside the network)
Windows PowerShell:
Test-NetConnection 203.0.113.10 -Port 8000
(look for TcpTestSucceeded : True)
macOS / Linux:
nc -vz 203.0.113.10 8000
nmap (scan only addresses you own or manage):
nmap -Pn -p 80,443,554,8000,9000,37777 203.0.113.10Run these from a laptop tethered to a phone on cellular, or from a computer at another site. The nmap example is a quick way to confirm that none of the common camera ports are open when you are checking exposure.
Reading the result
| Result | What it usually means | What to check |
|---|---|---|
| Open / succeeded | The forward works and something answers | If you did not intend this, remove the forward and check UPnP |
| Closed / refused | The router passed the connection, but nothing answered at the internal address | Recorder's internal IP changed, wrong internal port, or the service is disabled on the device |
| Timed out / filtered | Nothing came back | No forward rule, wrong protocol, ISP blocking the port, firewall on the router, or carrier-grade NAT |
| Works on Wi-Fi at the site, fails on cellular | You were testing locally | Retest from outside; check NAT loopback is not giving a false pass |
Common causes of a failed test
- Carrier-grade NAT (CGNAT). Common on cellular and some fixed-wireless and fiber services. Port forwarding cannot work; ask the ISP for a public IP or use P2P, a hosted VPN, or an outbound-connecting device. See P2P cloud vs port forwarding vs VPN.
- Double NAT. An ISP modem-router in front of your own router. Either put the ISP device in bridge mode or forward on both devices.
- Internal IP changed. Fix it with a DHCP reservation.
- ISP blocks the port. Some residential ISPs block common inbound ports such as 80. Use a different external port mapped to the same internal port.
- Public IP changed. Use DDNS.
Common questions
- Can I test a UDP port?
- Not reliably with online checkers, because UDP has no handshake and a silent port looks the same as a blocked one. Test the full path with the vendor's app on cellular instead.
- Is it legal to scan with nmap?
- Scan only addresses you own or are authorised to manage. Scanning someone else's network can break their acceptable-use terms or local law.
Stuck behind CGNAT or double NAT?
Our edge device connects outbound, so it works where port forwarding can't. Ask us whether it fits.