What is Port Range?
Updated: 3 days ago
A port range is a continuous set of numbered transport-layer ports between a starting port and an ending port, inclusive. Network administrators use port ranges to define which TCP or UDP traffic a firewall rule, router configuration, application or monitoring system should match. For example, TCP ports 5000–5010 form an 11-port range, not a range of 10.
A port number identifies a communication endpoint for a transport protocol on a device. It is not an IP address, a physical socket on your router or a measure of broadband speed. The same number can be used separately by TCP and UDP, and opening a range in a firewall does not prove that an application is running or that an internet connection can reach it.
What port numbers are available?
TCP and UDP each use a 16-bit port number field, so the numeric values run from 0 to 65535. Port zero is reserved and is not a normal destination for a publicly accessible application service. The Internet Assigned Numbers Authority (IANA) groups ports into three broad categories.
System or well-known ports: 0–1023. Commonly associated with established services, such as HTTPS on TCP 443.
User or registered ports: 1024–49151. IANA records registered service names here, although registration does not guarantee that a port is in use on any particular device.
Dynamic or private ports: 49152–65535. Often used for temporary client-side source ports, though an operating system may use a different configured ephemeral range.
The authoritative classification is maintained in the IANA Service Name and Transport Protocol Port Number Registry. Registration is not a firewall permission or an instruction that a service must use a particular port.
How does a port range work?
A rule usually combines a port range with other criteria: source and destination addresses, transport protocol, traffic direction, interface, connection state and an allow or deny action. A firewall might allow inbound TCP traffic addressed to destination ports 5000–5010 on one server, while blocking the same ports on another.
The rule tests whether the packet's relevant port value falls inside its configured interval. A TCP packet addressed to port 5005 matches the destination range 5000–5010. A packet addressed to 5011 does not. If the rule is for TCP, a UDP packet to port 5005 is not covered by that TCP-only rule.
Port range infographic
This diagram illustrates valid port numbers, a sample inclusive range, how a firewall matches a destination port and why a matching rule does not automatically make a service reachable.
How do you calculate the number of ports in a range?
For an inclusive range with start port S and end port E, the number of port values is E − S + 1, provided both endpoints are valid and E is at least S. The extra one is essential because both the starting and ending values count.
Example 1: ports 5000–5010 contain 5010 − 5000 + 1 = 11 port numbers.
Example 2: ports 8000–8000 contain exactly one port number.
Example 3: ports 10000–10999 contain 10999 − 10000 + 1 = 1000 port numbers.
Example 4: the entire numeric space 0–65535 contains 65536 possible values per transport protocol; this does not mean all values are assignable to ordinary services.
Do not add the TCP and UDP counts together unless the question explicitly asks for distinct protocol-and-port combinations. TCP 5005 and UDP 5005 are different transport endpoints even though the numeric port is the same.
Port range vs a single port
A single-port rule applies to one port value, such as TCP 443. A port-range rule applies to every value between two endpoints, such as TCP 5000–5010. Some router interfaces let you enter a comma-separated list of individual ports or multiple disjoint ranges; that is not one continuous range.
A wider range is not automatically better. It increases the set of destination ports that can match an allow rule. Prefer the smallest range genuinely required by the application, and specify the transport protocol rather than selecting both TCP and UDP without a reason.
Port range vs IP address range
An IP address range selects network addresses, such as 192.168.1.20–192.168.1.30. A port range selects transport-layer port values, such as 5000–5010. Firewall policies often combine both: allow a specific source IP range to access a specific destination port range on a particular server.
For IPv4 and IPv6, TCP and UDP port numbers remain 16-bit values. IPv6 changes the addressing layer; it does not increase the maximum TCP or UDP port number.
Port ranges in router port forwarding
Port forwarding can map an incoming public destination port or range to an internal device. A router might forward TCP 5000–5010 to a server at 192.168.1.50. Some routers preserve each port number; others let you translate a public range to a different internal range. Exact mapping behaviour depends on the router.
A port-forward rule is only one part of reachability. The application must listen on the expected port and protocol, the server firewall must allow it, the router must have a reachable public endpoint, and any upstream network restrictions must be considered.
For the full distinction between inbound mapping and local access, see What is Port Forwarding? and the separate explanation of NAT reflection in What is Hairpin NAT.
Does CGNAT stop port-range forwarding?
Carrier-grade NAT (CGNAT) can prevent unsolicited inbound IPv4 connections from reaching your home router, regardless of how many ports you open locally. If the public IPv4 address is held by an upstream ISP NAT, your router's forwarding rule cannot independently control that upstream mapping.
Some ISP environments offer managed inbound mappings or other arrangements, but these must be verified with the provider. A public IPv4 address, an appropriate tunnel or VPN, or an IPv6 service with correctly configured firewall access may be alternatives.
Source ports and destination ports
A connection typically includes a source IP address and port plus a destination IP address and port, alongside its transport protocol. A web browser might initiate a TCP connection from local port 53420 to a remote HTTPS server on TCP 443. The temporary source port identifies that client-side flow; the destination port identifies the remote service.
An ephemeral port range is the pool from which an operating system may choose temporary source ports. It is not necessarily the same as IANA's dynamic/private classification, and it varies across operating systems and configurations. Firewall rules referring to destination ports should not be confused with rules referring to source ports.
Port ranges for TCP and UDP
TCP is connection-oriented and is commonly used by HTTPS, SSH and many application protocols. A TCP port range rule does not automatically include UDP.
UDP is datagram-based and is used by services such as DNS queries, real-time media and many games. UDP traffic needs its own matching rules where required.
Some applications use both TCP and UDP, but they may use different ports or ranges for each. Follow the application's official documentation rather than guessing.
The same numeric port may be in use simultaneously for TCP and UDP on the same IP address because the transport protocols are distinct.
How to configure a port range safely
Identify the exact application and confirm which TCP and/or UDP ports it genuinely requires.
Choose the smallest contiguous range that covers those ports, or individual-port rules if the application needs only scattered values.
Confirm whether the rule applies to source or destination ports, which interface it covers, and whether the traffic is inbound or outbound.
Restrict source IP addresses where practical and check the target device's own firewall.
If using port forwarding, reserve the server's private IP address or otherwise keep its destination stable.
Test from a genuinely external network when validating inbound internet access, not just from the same WiFi.
Check logs and close unused rules. Keep exposed applications updated and protected with appropriate authentication.
How to test a port range
Testing every port in a large range is not the same as checking one representative port. For a small range, test the ports the application is actually meant to use. A port scan may show a port as closed, filtered or open depending on the protocol, application, firewall behaviour and scan method. UDP results are especially easy to misinterpret because silence does not necessarily mean a port is closed.
On a device you administer, use the operating system's listening-socket tools to confirm which applications are bound to which ports. Then test from the intended source network. Avoid treating a successful local connection as proof of public internet accessibility.
Common port-range mistakes
Off-by-one calculation: 5000–5010 includes 11 numbers, not 10.
Wrong protocol: a TCP rule does not cover UDP traffic.
Wrong direction: a source-port rule is not equivalent to a destination-port rule.
Too-broad exposure: allowing thousands of inbound ports when an application needs only two.
No listening service: an allowed port can still refuse connections if nothing is listening.
Wrong forwarding target: a changed private IP address sends traffic to the wrong device.
Upstream NAT: CGNAT or double NAT can stop inbound access despite a correct local rule.
Assuming the same port range works for every application: each service has its own documented requirements.
Does opening a port range improve broadband speed?
No. Opening or forwarding ports does not increase the line rate, bandwidth or throughput of your UK broadband connection. A correctly configured rule may enable an application to accept inbound traffic that was previously blocked, but it does not add capacity to the physical or wholesale access network.
Performance can still be affected by firewall processing, router hardware, congestion, latency, packet loss and application design. Those are separate questions from how many port numbers a rule matches.
Frequently asked questions
What is an example of a port range?
TCP 5000–5010 is a port range containing 11 inclusive values: 5000, 5001, 5002, 5003, 5004, 5005, 5006, 5007, 5008, 5009 and 5010.
What is the maximum port number?
65535 is the highest numeric TCP or UDP port value. Both use 16-bit port fields. Port zero is reserved rather than a normal service port.
Are port ranges the same for TCP and UDP?
They share the numeric interval 0–65535, but TCP and UDP are different protocols. Rules, listeners and service registrations need to be interpreted separately.
What is an ephemeral port range?
It is a configured pool of temporary source port values an operating system can select for outgoing connections. Its actual boundaries can vary by system and administrator settings.
Can I forward a port range behind CGNAT?
You can configure a rule on your own router, but that alone generally does not make the service reachable through an upstream ISP CGNAT. An appropriate upstream mapping or alternative access method is required.
Is it safe to open all ports?
Generally no. Allowing all inbound destination ports creates unnecessary exposure unless a very specific, tightly controlled architecture requires it. Use the minimum necessary ports, protocols and source addresses.
Does port 5000 mean the same thing on every device?
No. The same numeric port can be associated with different applications or configurations, and a port number alone does not identify the service. Consider the transport protocol, IP address and actual listening process.
Key takeaway
A port range is an inclusive interval of TCP or UDP port numbers used to match network traffic. The valid numeric space is 0–65535, and an interval contains end − start + 1 values. Port ranges help configure firewalls, forwarding and applications, but they do not guarantee service reachability or change broadband speed.
To explore the related technical concepts used in this Port Range guide, visit our broadband terminology guide.
