VPN Endpoint Prober
Enter a host you run and the VPN Endpoint Prober sends real WireGuard, OpenVPN, IKEv2 and TLS handshakes to it, then shows which ports answered, which stayed silent and which are closed, with the TLS certificate and who owns the address.
Sends real packets. Probe only hosts you run or have permission to test.
No host probed yet
Enter a host you are allowed to test and press Probe. Nothing is sent until you do. A silent host takes several seconds per probe.
Probes this session
Tap a row to probe that host again. UDP probes are not retransmitted, so run a host twice.How the prober works
The pwnsy VPN API resolves the host and refuses private, loopback, link-local, multicast and reserved addresses. It then sends five probes at the resolved address in parallel: a WireGuard handshake initiation over UDP, an OpenVPN hard reset over UDP and again over TCP on the same port, an IKEv2 SA_INIT over UDP, and a TLS handshake over TCP with the host name as SNI.
While the probes run, this page looks up the A, AAAA and CAA records for the name at dns.google. When the probes finish it asks the pwnsy API who owns the probed address (ASN, network name and country). The TLS certificate is read without validation, because an invalid or self-signed certificate is itself the finding.
Only the four ports you set are touched, with a handful of packets and no port sweep. A VPN on another port, behind port knocking or behind a CDN stays invisible. This browser remembers the last host that probed successfully so the field is filled next time; ports reset to the defaults on every visit. The session table is cleared when you leave the page.
How to read the result
Confirmed
A reply only that protocol makes: a WireGuard handshake response, an OpenVPN hard reset, an IKEv2 SA_INIT or notify, or a completed TLS handshake.
Silent
Nothing answered. A hardened server and a firewall that drops packets look identical, so silence is never upgraded to a detection.
Closed
Every other outcome: an ICMP unreachable reply, a refused TCP connection, a TCP connection that timed out (the port is filtered or the host is down) or a probe that failed. Nothing on that port answered like a VPN.
The Owner tile turns amber when the address belongs to a CDN or a large cloud edge such as Cloudflare, Akamai, Fastly or CloudFront, because the probes then reach the edge and miss the origin. Expand a protocol row for its port state, round trip time and, on the TLS port, the certificate: version, cipher, ALPN, subject, issuer, days to expiry, whether it names the host, SAN list and serial.
Questions
Which hosts can I probe?
Only hosts you run or have permission to test. Each request probes one public host on four ports with a handful of packets. Private, loopback, link-local, multicast and reserved addresses are refused.
Why is a port silent instead of closed?
A WireGuard server and an OpenVPN server with tls-auth or tls-crypt drop packets from strangers without replying. A firewall that drops traffic looks the same from outside. Silent means nothing answered, so it never counts as a detection.
Why does a host behind Cloudflare show nothing?
When the address belongs to a CDN, the probes reach the CDN edge. The origin server and any tunnel behind it stay invisible, and the Owner tile is marked amber.
Why is a self-signed certificate on 443 flagged?
Public web servers almost never present one. OpenVPN over TCP, SSTP and stealth modes often do, so a self-signed certificate on a TLS port is a strong hint that a tunnel endpoint is answering.
Can I probe ports other than the defaults?
Yes. Open Ports to set each protocol's port, or pick a port set such as Stealth 443 or SSL-VPN 10443. A port written in a URL, such as host:8443, becomes the TLS port.
Probes run live from the pwnsy VPN API. Packet formats follow the WireGuard protocol, the OpenVPN wire protocol and RFC 7296. DNS via dns.google.