Port Forwarding Explained: Open a Port on Your Router Safely
How to forward a port on a home router in five steps, why it fails behind CGNAT, and how to keep it safe.
Port forwarding sends traffic that arrives at your router on one port to a device inside your network. Menu names differ between routers (Port Forwarding, Virtual Server, NAT), but the steps are the same.
Steps
- Give the device a fixed private address. Reserve it in the router’s DHCP settings, or set a static address outside the DHCP range, so the rule does not break when the address changes.
- Find the port and protocol the program needs (TCP, UDP or both). Use only the ports you need.
- Log in to your router. Use the router IP finder if you do not know the address.
- Add a rule: external port, the device’s private address, the internal port and the protocol. Save it.
- Allow the port in the device’s own firewall, and make sure the program is listening on it.
- Test from outside your network, for example on mobile data. Testing from inside can fail even when the rule is right.
- Delete the rule when you no longer need it.
If the port will not open
- The port still shows as closed
- Check the device has the private address you set, the program is running, and the device firewall allows the port. Then test from another network.
- The router’s internet address is not your public address
- Compare the address on the router’s status page with the one a ‘what is my IP’ site shows. If they differ, or the router address starts with 100.64 to 100.127, your ISP shares one public address between customers (CGNAT, RFC 6598) and forwarding will not work. Ask the ISP for a public address or use a tunnel or relay service.
- It works from inside but not outside
- Some routers cannot loop traffic back to their own public address. Use the device’s private address inside your network.
- Two routers in a row
- Forward the port on both, or put the first router in bridge or access-point mode. See own router behind an ISP router.
Questions people ask about Port forwarding
- Is port forwarding safe?
- It exposes that one service to the internet, so keep the program updated, use strong logins, open only the ports you need, and remove rules you no longer use.
- Do I need port forwarding to host a game or a web server?
- Usually yes, unless the program or a relay service handles it for you.
- What is the difference between TCP and UDP?
- TCP checks that data arrives. UDP does not. The program’s documentation says which one it uses.
Related pages
- Find your router IP
- Login not working
- Forgot password and reset
- Change Wi-Fi password
- Default IP list
- Security checklist