Future TechnologyHow to Check What Ports Are Exposed to the Internet
Key takeaways
- Every edge appliance breach this year has the same shape, where a device faces the internet because that is its job and a pre-authentication flaw turns reachability into access
- Scan your public range from outside the network, because an internal scan sees firewall rules that an external attacker never hits
- For each open port, answer one question: does this need to be reachable from the open internet, or only from the VPN
CVE-2026-83548 scores a 10.0 and needs no password. That is the SonicWall SMA 1000 flaw CISA added to its exploited catalogue this month, and the reason it works is the least technical part of the story. The appliance faces the internet because facing the internet is its job.
Every edge appliance story this year has that shape. A VPN box or remote access gateway sits at the perimeter, someone finds a pre-authentication flaw, and the attack is simply reaching it. Patching fixes any single one of them. Knowing what you have exposed is what helps with the next one.
Step one: find your actual public IP range
Start with what the internet can see rather than what the network diagram says. Your ISP or hosting provider allocated a range. Cloud accounts add more: every public load balancer, every instance with a public address, every managed service still on a default configuration.
Write the list down. Most teams find at this stage that it is longer than anyone expected.
Step two: list what is meant to be listening
Before scanning, write down what you believe should be reachable. Web servers on 443. Mail on 25 and 465. Everything else needs a name against it and a reason.
Doing this first turns the scan into a comparison instead of a discovery exercise, and a comparison is much harder to rationalise away.
Step three: scan from outside, not inside
An internal scan sees the network the way you do, with firewall rules already applied. Run it from a machine outside the perimeter: a cloud VM, a home connection, anything on a different route in.
Free external port scanners are fine for a quick pass. For infrastructure you own properly, nmap from an external host gives you the detail. Shodan will also show what it has already indexed about your ranges, which is a reasonable approximation of what an opportunistic attacker sees before they touch anything.
Step four: ask the VPN question
For every open port, one question: does this need to be reachable from the open internet, or only from the VPN?
Management interfaces are almost always the second answer. Admin panels, IPMI, database ports, hypervisor consoles, and the web UI on the appliance itself. Usually nobody has ever checked, and the port has been open since installation because the default was open. The same question applies at home, including to anything you have put on a public port while self-hosting models rather than paying per token.
Step five: recheck after every change
Exposure drifts. A firewall rule added for a migration and never removed. A new service with a public default. A vendor appliance that quietly reopens a port after a firmware update.
Put the scan on a schedule and pair it with a regular check of the CISA KEV catalogue, so you know when something on your list has become interesting to attackers. The SonicWall SMA 1000 advisory is a good example of how quickly that happens.
None of this needs new tooling or budget. It needs someone to sit down and read the list.