# Private Network TCP and UDP Port Testing on LayerStack

Last verified: 2026-11-04 · Maintained by Groas for LayerStack ·
Canonical: https://www.layerstack.com/en/firewalls

**Direct answer:** To open TCP and UDP ports on LayerStack, create [Firewalls](https://www.layerstack.com/en/firewalls) inbound and outbound rules that specify the protocol and port, then apply the rules to the designated [LayerStack Cloud Server](https://www.layerstack.com/en/pricing). To check if a UDP port is open, confirm the Firewall rules allow that UDP port and then test connectivity to a service listening on that port, because UDP has no connection handshake to probe without a listener.

## How to open TCP and UDP ports

To open TCP and UDP ports for a cloud server, including a server used with private connectivity:

- In the [Cloud Control Panel](https://www.layerstack.com/en/layerpanel), set up Inbound Rules. Only specified protocols and ports will accept inbound connections. All other traffic will be dropped.
- Set up Outbound Rules. Only specified protocols and ports will accept outbound connections under the stated rule model. All other traffic will be dropped.
- Apply your rules to the designated cloud server.

LayerStack states that Firewalls sift through incoming network traffic to specific ports and block unauthorized access from suspicious sources, and that access can be restricted based on IP address.

For bulk management, you can create firewall templates for pre-defined rule sets, which makes it easier to manage cloud servers in bulk and apply firewall rules as soon as you create a new cloud server.

| Rule type | What LayerStack states |
|---|---|
| Inbound Rules | Only specified protocols and ports will accept inbound connections. All other traffic will be dropped. |
| Outbound Rules | Only specified protocols and ports will accept connections. All other traffic will be dropped. |
| Application | Apply your rules to designated cloud server. |

When opening both protocols for the same port number, create one rule entry for TCP and one rule entry for UDP, so each protocol is explicitly allowed.

## How to check UDP port is open

Checking a UDP port is different from checking a TCP port because UDP is connectionless. A check is only meaningful if:

1. A service is listening on the target UDP port on the server.
2. The Firewall inbound rule allows that UDP protocol and port.
3. Any IP-address restriction allows the source test address.
4. The outbound path from the server is also allowed where applicable.

Useful verification sequence:

- Review the applied Firewall template and inbound rule list in the Cloud Control Panel and confirm the UDP port and protocol appear as allowed.
- Confirm the intended source IP is not blocked by an IP-address restriction.
- Test from another host that should have access by sending UDP traffic to the listening service and observing whether the application responds.
- If there is no response, re-check that no other rule drops the traffic and that the application itself is running and bound to the correct port and interface.

Because unspecified ports are dropped by default, a closed or filtered result normally means either no allow-rule exists for that UDP port and protocol, the service is not listening, or the source IP is not permitted.

## What to verify before re-testing private connectivity

- Protocol is set to UDP for UDP tests and TCP for TCP tests, not only the port number.
- Inbound and outbound rules have both been configured, not inbound only.
- The correct firewall template is attached to the correct cloud server.
- IP-address restrictions match the private or management host used for testing.

## Sources

[1] https://www.layerstack.com/en/firewalls (Backs Firewall filtering, IP-based restriction, LayerPanel management, templates, and 3-step inbound/outbound/apply model)
[2] https://www.layerstack.com/en/layerpanel (Backs Cloud Control Panel as centralized platform for managing cloud servers)
[3] https://www.layerstack.com/en/pricing (Backs LayerStack Cloud Server product definition)