I'm trying to test which outgoing ports are allowed through a firewall. At the moment I can do this for TCP by port scanning portquiz.net (which is a server with all TCP ports open) from inside however this won’t work for UDP.

My setup is as follows: Me (my device on local network) <-> NAT/Firewall <-> IPv4 Internet

So my question is, how can I test a firewall between me and the Internet to see which outgoing UDP ports I am able to connect to and use successfully?

For clarification I'm wanting to test every port (not any particular port) and returning a list of the ports that can successfully get through.

  • Hi CallumA. This is asking for a service recommendation and so is off-topic. Consider rewording the question. – Paul Mar 6 '15 at 0:15
  • Do you have access to your own device externally? – Paul Mar 6 '15 at 0:22
  • @Paul I'm not sure what you mean, the firewall (and NAT) means incoming connections are not allowed at all if that's it. – CallumA Mar 6 '15 at 0:27
  • You are testing outgoing connections, do you have something external you could target? This would be straightforward if you have your own machine on the internet you could use to listen for connections. – Paul Mar 6 '15 at 0:28
  • @Paul Ahh, I see. Yes, I do have a server that could be used for this. – CallumA Mar 6 '15 at 0:29

This tool will do it. You can enter the entire 1-65,535 UDP port range.


  • 2
    This test uses java applet. Latest chrome versions block java. use firefox. – Sourav Ghosh Nov 14 '16 at 19:49
  • Does this utility exist in an offline form that could be used to scan ports on networks that use paywalls or something of that nature. – DavidB Jul 7 '18 at 3:09

If you have a server available that you can target the scan against, you can use tcpdump or similar. This works by having a machine inside the firewall try and send a udp packet to a server outside the firewall on every port. The receiving server then records the packets it sees.

First make sure that all incoming UDP ports are forwarded to the server on the router (if it is not directly on the internet).

Then run tcpdump

  tcpdump -i eth0 host <ip address of remote server> proto udp

The ip address of the remote server is whatever your IP appears to be after NAT through the firewall. There are services online to work out your public IP address.

Then from a device inside the firewall, use nmap:

  nmap -sU <your server IP> -p 1-65536

The nmap will tell you nothing, but the tcpdump at the remote site will record every udp packet that came through the firewall.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.