portop Firewall
For every listening port the network can reach, portop asks the host firewall whether incoming traffic gets through.
Verdicts
| Verdict | Meaning |
|---|---|
allowed | Anyone can connect, or no firewall is running |
restricted | Only some sources may connect |
blocked | Incoming connections are refused |
? | portop cannot tell |
Loopback ports show -: the firewall does not matter for them.
What each system reports
| System | Read from | Unknown when |
|---|---|---|
| Linux | ufw rules and default policy; firewalld's default zone (ports, services, target); an empty nftables ruleset means no firewall | portop is not root (the tools refuse), or nftables input rules or firewalld rich rules apply |
| macOS | The application firewall's global state | It is on but not blocking everything, since it decides per application |
| Windows | Windows Firewall profiles | Any active profile is on, since rules are per program and slow to enumerate |
Rules are read at most every 30 seconds. Turn the check off with --no-firewall or resolve_firewall: false.