Ports and protocols: what is reachable at each provider

A service can run without a fault and still be unreachable, because its port or its protocol is blocked somewhere between the user and your virtual machine. From outside, that looks the same as a service that has crashed.

This page says which ports are reachable at each provider, which port and protocol to choose, and how to check a port in two commands.

Which ports are open at each provider

Provider	Reachable from the internet
ProVM	All ports
OVH	All ports
Hetzner	Only TCP ports 80, 443 and 19000 to 19100
Vultr, DigitalOcean, Google Cloud, Gcore, Scaleway	No rule is stated here. Test the port you need

Hetzner

On a Hetzner VM, only these ports can be reached from the internet:

• TCP 80
• TCP 443
• TCP 19000 to 19100

Every other port is unreachable, and so is UDP on any port. The limit is applied in front of the VM, not inside it: opening a port in the VM’s own firewall does not change it.

On Hetzner, put a web service on 443 and any other TCP service on a port between 19000 and 19100. For a service that needs UDP or a fixed port outside this list, choose ProVM or OVH.

ProVM and OVH

All ports are open. A service is reachable on any port it listens on, unless a firewall inside your VM blocks it.

Note

The provider is chosen when the VM is created and cannot be changed afterwards. If you find out later that the port you need is not reachable, create a new VM at ProVM or OVH and move the service. See Providers and locations.

Which port to choose

The rest of the way matters too: the networks of your users, such as offices, mobile carriers and public Wi-Fi, also block ports.

• Ports 80 and 443 pass almost everywhere. Nearly all web traffic uses them, so a network that blocked them would break the web for its own users.
• High, unusual ports are blocked or slowed down by some networks, without any message. A service on port 8443 can work from your office and fail from a phone.

So:

1. A web service, an API or anything that can speak HTTPS: use TCP 443. Use 80 only to redirect to 443.
2. A TCP service that cannot use 443: on Hetzner use a port between 19000 and 19100. On ProVM and OVH any port works.
3. A service that needs UDP, for example WireGuard: use ProVM or OVH.

TCP or UDP

• TCP checks that the data arrives. A lost packet is sent again. On a bad network TCP gets slower, but the data arrives complete. Use it for websites, APIs, file transfer and anything where every byte counts.
• UDP does not check. A lost packet is gone. That is fine for a video call, where one lost frame does not matter, and wrong for anything that needs all the data.

On an unstable network TCP is the safer choice. Choose UDP only when the application deals with loss itself.

Check a port

Do not assume that a port is reachable. Check it, with one command on the VM and one from outside.

1. On the VM: is the service listening?

sudo ss -tlnp

Each line is a TCP port that a program listens on. Use sudo ss -ulnp for UDP. Look at the address in front of the port:

• 0.0.0.0:8080 or *:8080 or [::]:8080: the service accepts connections from outside.
• 127.0.0.1:8080: the service accepts connections only from the VM itself. Change its configuration to listen on 0.0.0.0.
• Your port is not in the list: the service is not running, or it listens on another port.

2. From another computer: does a connection reach the port?

Run this from your own computer, not from the VM. Replace the address and the port with yours.

nc -zv 203.0.113.10 8080

Answer	What it means
succeeded or open	The port is reachable
Connection refused	The connection reached the VM, but nothing listens on that port, or the VM’s firewall rejects it
No answer, then a timeout	The connection is dropped on the way: by the VM’s firewall or by the provider’s port rule

If the first command shows the service listening and the second one fails, the application is not the problem. Stop restarting it and look at the firewall and the port rule.

If the port is not reachable

Go through these in order.

1. Is the service listening on that port, and on 0.0.0.0? See the first command above.

2. Does the VM’s own firewall allow the port? Which firewall is active depends on the operating system.

   sudo ufw status verbose                      # Ubuntu, Debian
   sudo firewall-cmd --list-all                 # AlmaLinux, Rocky Linux, Fedora
   sudo iptables -L INPUT -n --line-numbers     # any system

   A command that is not found means that firewall is not installed. Look for a rule that drops or rejects your port, or for a default of “deny” without a rule that allows your port.

3. Does the provider allow the port? On Hetzner only TCP 80, 443 and 19000 to 19100 get through. Move the service to one of these ports.

4. Is the service in a container? The port must be published to the VM, for example with -p 8080:8080 in Docker, or the first command will not show it.

5. Test from a second network, for example a phone’s mobile data. If the port answers from one network and not from another, the network of the user blocks it. Move the service to 443.

If the VM does not answer at all, on any port, see My VM is unreachable.