Free tools Windows power users keep installed
One-click scans. No signup required.
If a VPS works locally but not from the internet, trace the connection through every layer instead of opening random ports. Verify the hostname resolves to the current public address, confirm the service is listening on the right interface and protocol, inspect the guest firewall, inspect the cloud or provider firewall, check the route back to the client, and then test the exact port from an external network. A successful ping proves only that some ICMP traffic is getting through; it does not prove that SSH, HTTP, or any other application port is reachable.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Use this order to find the blocking layer
Internet traffic to a VPS normally crosses several independent controls: DNS and address selection, the provider network, the VPS route, the operating-system firewall, and the application listener. A pass at one layer does not imply a pass at the next. Work from the endpoint inward, changing one thing at a time so that each test identifies a specific layer.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems1. Confirm the endpoint and test from outside
Start with the name the client actually uses. Resolve both address families and compare the result with the VPS’s current public addresses:
dig +short A vps.example.com
dig +short AAAA vps.example.com
nslookup vps.example.comOn Linux, getent ahosts vps.example.com also shows the addresses selected by the local resolver. Check that an A record points to the current public IPv4 address and that an AAAA record is intentional and current. A stale record, a private address, or an address belonging to an old VPS sends the test to the wrong machine. If the name has both A and AAAA records, an operating system may try IPv6 first; test each address family separately.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Run the test from a network that is not inside the provider’s private network: a phone hotspot, an office connection, or another server in a different network. Testing from the VPS itself, or from a peered network, can bypass the public path and produce a false success. Record the exact hostname, resolved address, protocol, port, source network, and result.
2. Confirm that the service is listening
A firewall cannot make an application listen. On the VPS, inspect listening sockets and identify the owning process:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchsudo ss -lntup
sudo ss -lntup | grep ':22'
sudo ss -lntup | grep ':443'The first command lists TCP and UDP listeners; the filtered examples check common SSH and HTTPS ports. Confirm that the expected process is running, that it uses the intended TCP or UDP protocol, and that the port number matches the client configuration. A service can be running while listening on a different port than the one opened in the firewall.
Pay close attention to the local address. A listener on 127.0.0.1:8080 accepts only connections originating on the VPS. It is invisible to the public network even when every firewall rule allows port 8080. A listener on the VPS’s private interface, public interface, or 0.0.0.0 can accept IPv4 connections subject to firewall rules. For IPv6, the service must listen on an IPv6 address, commonly ::, and the host and provider must permit IPv6 traffic.
Google Cloud’s guidance expresses the requirement precisely: “The server must be bound to the IP address of a particular interface or to 0.0.0.0, and it must accept connections from the correct client IP prefix or 0.0.0.0.” Change the application’s bind setting only as broadly as necessary. Binding to every interface may expose an administrative service that was intended to remain local.
3. Check the VPS guest firewall
The operating system may drop traffic before it reaches the application. Identify which firewall framework is active and inspect its effective rules, not just a configuration file that may no longer be loaded:
- UFW:
sudo ufw status verbose - firewalld:
sudo firewall-cmd --get-active-zonesandsudo firewall-cmd --list-all - nftables:
sudo nft list ruleset - iptables:
sudo iptables -L -n -v
For the rule that should permit the connection, verify all of the matching fields: direction, interface, source range, destination port, and protocol. A rule for TCP does not permit UDP. A rule for port 22 does not permit port 2222. A rule limited to a private subnet does not permit an internet client. If the VPS has more than one interface, make sure the rule applies to the interface carrying the public traffic.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Packet counters are especially useful. Google Cloud recommends examining iptables counters; a counter that rises on a matching DROP rule confirms that packets are being discarded there. Its documentation example shows 10,342 packets and 2,078,513 bytes on a rule. Those figures illustrate how to interpret a counter, not a prevalence statistic or a measurement of your VPS. Take a baseline, make one external probe, and check which counters changed.
Do not disable the guest firewall as a troubleshooting shortcut. If you need a temporary diagnostic rule, limit it to the tested port and a known source CIDR, perform one probe, and remove or tighten the rule immediately after the test. A successful test with a temporary allow rule identifies the blocking layer; it does not justify leaving the host unrestricted.
4. Inspect the provider-side firewall
Cloud network controls are separate from the Linux firewall. An allow rule inside the VPS cannot override a provider rule that drops the packet before it reaches the virtual network interface. Review the effective, attached rules for the correct virtual machine, network, direction, protocol, destination port, and source range.
Different platforms expose different names for these controls:
| Platform | Provider controls to inspect | What to verify | Useful diagnostics |
|---|---|---|---|
| AWS | Security groups, network ACLs, route tables, Network Firewall | Internet ingress rule, protocol and port, source range, subnet route, and any additional network policy | Provider flow or reachability information plus guest-firewall checks |
| Google Cloud | VPC firewall rules | Direction, protocol, destination port, source range, target selection, and IPv4 or IPv6 coverage | Connectivity tests and guest iptables packet counters |
| Azure | Network Security Groups, routes, and forced-tunneling configuration | Rule priority, inbound allow, protocol and port, source range, and the return route | Effective NSG view, route inspection, and guest-firewall checks |
Google Cloud provides connectivity tests that can identify a dropped hop. AWS lists the security group, network ACL, route table, Network Firewall, and operating system as separate possible causes of an internet-to-instance failure. Azure documents NSGs, guest firewalls, and routes separately and notes that default rules can block inbound internet traffic until a higher-priority allow rule exists. In every platform, inspect the rule set that is actually attached to the instance or interface; editing an unused template or a rule for another network has no effect.
5. Verify the route and return traffic
Reachability is two-way. The inbound packet must arrive, and the reply must leave through a valid interface and route. On the VPS, inspect the IPv4 and IPv6 routes:
ip route
ip -6 routeConfirm that a default route or a more-specific route sends replies toward the provider’s expected gateway. Check whether a second interface, virtual appliance, VPN, or forced tunnel changes the path. AWS’s troubleshooting checklist includes route tables; Azure identifies route problems and forced tunneling as possible causes. A packet can reach the VPS and still time out when the reply takes an interface that cannot reach the client’s source network.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
When a provider offers an effective-route or connectivity-test view, use it. These tools show the route and policy decision as the provider sees them, which is more reliable than inferring the path from a local configuration file.
6. Probe the exact protocol and port
Use a protocol-specific test from the external network:
- TCP:
nc -vz -w 5 HOST PORTreports whether a TCP connection can be established. - HTTP:
curl -v --connect-timeout 5 http://HOST:PORT/tests both the TCP connection and the HTTP exchange. Usehttps://when the service expects TLS. - Windows: Microsoft’s TCPing tests the specified TCP port. Use the VPS hostname or address and the exact port configured for the service.
A TCP probe that times out usually indicates filtering, a missing route, or a silent listener. “Connection refused” generally means the host was reachable but no process accepted the connection, or an active firewall rejected it; return to the listener and guest-firewall checks. A successful ICMP ping does not establish a TCP session, and a failed ping does not prove that TCP is blocked. Microsoft recommends inspecting the guest firewall when TCP tests fail and explicitly warns against disabling that firewall as a fix.
Guest firewall and provider firewall are different controls
Think of the path as a sequence: client address selection, provider ingress policy, virtual routing, the VPS interface, the guest firewall, and the application. The provider policy can drop a packet before the VPS sees it. The guest firewall can drop it after it arrives. The application can reject it after both controls allow it. This explains why “the port is open” is incomplete unless you specify where it is open.
Recommended Free Tools
| Control location | Typical matches | Default or priority behavior | Diagnostics |
|---|---|---|---|
| Guest operating system | Protocol, destination port, source range, interface, direction | Depends on UFW, firewalld, nftables, or iptables policy and rule order | Effective rule listing and packet counters |
| Provider network | Direction, protocol, destination port, source range, target or interface, address family | Platform-specific priorities and default-deny behavior can apply before the guest sees traffic | Effective-rule views, flow information, and provider connectivity tests |
A local check such as curl http://127.0.0.1:8080 validates only the loopback path and the application. It says nothing about DNS, the public interface, provider policy, or the return route. Test the service on the address that an external client should use, then repeat from a genuinely external network.
Make narrow firewall changes safely
Once the blocking layer is identified, change the smallest rule that can solve the problem. The exact command depends on the distribution and the firewall framework, but the scope should always be explicit.
Limit administrative access by source
For SSH or another management port, prefer a specific administrator CIDR rather than an internet-wide rule. In UFW, a rule can be scoped to a source address, for example:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
sudo ufw allow from 203.0.113.4/32 to any port 22 proto tcpThe address above is an example documentation range; replace it with the real, trusted source range. Review the result with sudo ufw status numbered. Equivalent restrictions can be expressed with firewalld, nftables, or provider rules. Keep the provider rule and the guest rule consistent: allowing a narrow source at one layer while allowing everyone at the other layer does not improve the broader exposure.
Open application ports by protocol
For a web server, allow the port and protocol the server actually uses, such as TCP 80 or TCP 443. Do not assume that opening TCP also opens UDP, or that opening IPv4 automatically creates an IPv6 path. If an application intentionally uses UDP, create and test a UDP rule and use an application-level probe that can report a response; a TCP test cannot validate UDP.
Retest after one change
- Record the old rule, the intended source range, protocol, destination port, interface, and address family.
- Apply one narrow change at the layer identified by counters or provider diagnostics.
- Repeat the same external probe from the same source network.
- Check the guest counter or provider diagnostic again and record whether the decision changed.
- Remove temporary rules and retain only the minimum permanent access required by the service.
Changing several layers at once hides the cause and often leaves an unnecessarily broad opening. A controlled retest gives you a reproducible result for future incidents.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Protocol and address-family traps
TCP versus UDP
Firewall rules and listeners are protocol-specific. A TCP listener on port 53 does not answer UDP queries, and a TCP allow rule cannot make a UDP service reachable. Confirm the application’s documented transport, inspect the corresponding listener, and test with a client that speaks that transport. If a service uses both protocols, verify both rules and both listeners independently.
IPv4 versus IPv6
IPv4 and IPv6 can have different DNS records, routes, listeners, and firewall rules. A host may work over IPv4 while an AAAA record directs clients to an IPv6 address with no route or no allow rule. Compare explicit tests to each address family, for example by using the numeric address with your TCP or HTTP probe. Correct the AAAA record, add the required IPv6 listener and rules, or remove an unintended AAAA record; do not assume that an IPv4 fix covers IPv6.
Source-range mismatches
The source seen by the VPS may differ from the address you expect because of NAT, a corporate proxy, a VPN, or a provider network design. A rule that allows a private client address will not match the public address presented after NAT. Use the source range shown by provider diagnostics or logs, and keep it as narrow as practical.
Read the symptom instead of guessing
| Observed result | Most useful interpretation | Next check |
|---|---|---|
| Hostname resolves to an old or private address | The probe is not reaching the intended VPS | Correct DNS or the client endpoint, then retest externally |
| Local request succeeds; external TCP probe times out | Provider policy, guest firewall, route, or bind address is blocking the public path | Check listener address, effective firewall rules, counters, provider rules, and return route |
| External probe reports connection refused | The host path is reachable, but no suitable listener accepted the connection or an active reject occurred | Verify process state, port number, bind address, and reject rules |
| Ping succeeds; SSH or HTTP fails | ICMP reachability does not imply application-port reachability | Run a TCP-specific probe and inspect the exact protocol and port |
| IPv4 works; IPv6 fails | The address-family path has a separate DNS, route, listener, or firewall problem | Check AAAA, IPv6 listener, IPv6 route, and IPv6 provider and guest rules |
| One client network works; another fails | Source-range policy, NAT, route, or client-network filtering differs | Compare the source addresses and provider and guest rule matches |
| Packets hit a DROP counter | The displayed guest rule is discarding the traffic | Adjust that rule narrowly, then repeat the same external probe |
Platform-specific checks
AWS virtual machines
Inspect the security groups attached to the instance’s network interface, then check network ACLs for the subnet and the route table for the subnet’s path to the internet gateway or other required next hop. If Network Firewall or another network appliance is present, include it in the path. Finally, verify the guest listener and operating-system firewall. An allow in the security group cannot repair a missing route, and a correct route cannot repair a guest firewall drop.
Google Cloud virtual machines
Review the effective VPC firewall rules for direction, protocol, destination port, source prefix, target selection, and address family. Use a connectivity test when available to identify the hop or rule that drops traffic. On the VM, correlate the test with iptables counters or the active nftables ruleset. Confirm that the service binds to the required interface and accepts the client’s source prefix, rather than only loopback.
Azure virtual machines
Inspect the effective Network Security Group rules and their priorities, including rules inherited at the subnet and network-interface levels. Check the route table and any forced-tunneling configuration, then inspect the guest firewall and listener. An inbound allow with a lower priority than a deny is ineffective; the effective priority, not the rule’s name or location in a template, determines the result.
Common recovery scenarios
SSH is unavailable after a firewall change
Use the provider’s console or out-of-band access if available instead of repeatedly probing from the internet. Restore a narrow TCP rule for the actual SSH port and trusted source range, verify that the SSH daemon listens on the expected interface, and confirm the provider rule and route. Keep an existing management session open while testing a new rule so that a mistake does not remove your only access path.
A web service is reachable on localhost but not its public address
Check the listener first. If it is bound to 127.0.0.1, change the application’s bind setting to the intended private or public interface and restart it according to that application’s procedure. Then test the public address from outside, verify TCP 80 or 443 at both firewall layers, and confirm that DNS points to the same address you tested.
Ping works but the website does not
Do not add an ICMP rule and assume the website will follow. Use curl -v against the HTTP or HTTPS port, confirm a TCP listener, and inspect TCP-specific provider and guest rules. If the service uses TLS, test the correct HTTPS scheme and port; an HTTP probe against a TLS-only listener can fail even when the port is reachable.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The port works from the VPS but not from the internet
A loopback success proves the process is alive, not that it is publicly bound. Check the listening address, then trace provider ingress, guest filtering, and the return route in that order. A packet counter that increments on a drop rule or a provider connectivity test that identifies a denied hop gives you a concrete change to make.
Security rules that prevent a troubleshooting fix from becoming a breach
- Allow only the protocol and destination port the service needs.
- Restrict administrative ports to trusted source CIDRs whenever possible.
- Apply equivalent intent at the provider and guest layers; do not compensate for uncertainty by allowing every source and port.
- Keep IPv4 and IPv6 rules deliberate and test both when both address families are published.
- Use rule priorities and effective-rule views rather than assuming that a newly created allow rule wins.
- Use packet counters, flow information, and connectivity tests to identify the drop instead of disabling protection.
- Remove temporary diagnostic rules and document the final source range, protocol, port, interface, and test result.
Following the layers in order turns an outside-reachability failure into a bounded question: is the client using the right address, is a process listening, did the packet pass the guest and provider policies, and can the reply return? Answering those questions with an external, protocol-specific probe is faster and safer than opening all ports or relying on ping.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
