Port forwarding explained
What a rule really does, how to add one without regretting it, and the five reasons yours is not working.
Ports, in one paragraph
If an IP address is a building, a port is an apartment number. One address, 65,535 numbered doors, each of which can host a different service. Web traffic conventionally uses 443, mail servers use 25, and a Minecraft server uses 25565. The number is just an agreement about which door to knock on.
Why outgoing works and incoming does not
Every connection you start works without any configuration. Your router notes it, picks a source port, and remembers where the reply belongs. That is NAT, and it is invisible because it always works.
Incoming connections are the opposite problem. Nothing inside your house asked for them, so there is no entry in the table and the router has no idea which of your devices the traffic is for. It drops it, which is the correct and safe default.
Before you start: is it even possible?
Check this first, because it takes two minutes and it decides whether the next twenty are wasted.
- Find your router's WAN or internet address on its status page. How to get into the router.
- Compare it with the address on our front page.
| What you see | What it means |
|---|---|
| They match | You have a real public address. Forwarding will work |
Router shows 100.64 to 100.127 | Carrier-grade NAT. Forwarding cannot work. The second translation is on your provider's equipment |
| Router shows a private range and they differ | Double NAT. Another router or a modem in gateway mode is in front of yours |
No setting on your router will fix it. Your options are to ask your provider for a public address, which many offer free or cheaply on request, or to use something that connects outward instead: a hosted relay, a mesh VPN, or a small cloud server your home connects to. Hours are lost to this every day by people who never checked.
Adding a rule
- Give the device a fixed private address first. Use a DHCP reservation in the router rather than setting a static address on the device. Skip this and the rule will point at the wrong machine the first time addresses shuffle after a power cut.
- Open the router's settings and find Port Forwarding, sometimes called Virtual Servers, NAT Forwarding, or Applications and Gaming.
- Create a rule with the external port, the internal address, the internal port, and the protocol.
- Save, and expect a reboot on some models.
Name minecraft External port 25565 Internal IP 192.168.1.31 reserved, so it will not move Internal port 25565 Protocol TCP UDP for most voice and some games
You can forward external 8443 to internal 443. That is worth doing for anything on a well-known port, because automated scanning hits the obvious numbers hardest. It is a small speed bump rather than security, but it is free.
Why yours is not working
In the order worth checking.
1. You are testing from inside your own network
The most common cause by a wide margin. Many routers cannot loop a connection to their own public address back inside, a behavior called NAT hairpinning. Your rule may be perfect and still appear broken. Test from mobile data with Wi-Fi off, or ask someone outside.
2. Carrier-grade NAT
Covered above. Check before anything else.
3. The device's address changed
The rule points at 192.168.1.31 and the device is now .42 after a reboot. This is what the DHCP reservation prevents.
4. The device's own firewall is blocking it
The router forwarded it correctly and the operating system dropped it. Windows in particular blocks inbound connections for anything it considers a public network.
5. Double NAT
Two routers, each translating. Forwarding on the inner one does nothing because the outer one already dropped the traffic. Put the provider's box into bridge or passthrough mode so only one device translates.
A sixth, occasionally: some providers block inbound traffic on ports 25, 80 and 443 on residential lines. If a rule works on an unusual port and fails on a common one, that is likely why.
What UPnP does, and whether to leave it on
UPnP lets applications create forwarding rules by themselves, without asking you. It is why a console usually reports a healthy NAT type without anyone configuring anything, and it is genuinely convenient.
It is also unauthenticated by design. Anything on your network can open a port, including something you did not install deliberately, and the list of what is currently exposed may not match what you think you configured.
A reasonable position: leave it on if you play console games and nothing sensitive is on the network. Turn it off if you have deliberately configured your forwarding, and accept that you will occasionally have to add a rule by hand. Either way, look at what it has opened.
The safety part, stated plainly
A forwarding rule opens a permanent, unauthenticated path from the entire internet to one service in your house. The whole address space is scanned continuously by automated systems, so anything you expose is found within hours, whether or not anyone was looking for you.
- Forward the minimum. One port, one device. Never use the DMZ setting, which forwards everything.
- Patch what is behind it. Cheap cameras and old network storage are the classic examples of things that get exposed and never updated.
- Never leave a default password on anything reachable.
- Delete rules you stopped using. An old rule for a game you no longer play is pure liability.
- Consider not forwarding at all. A mesh VPN or a relay service gets you remote access with nothing exposed, and for most people that is the better answer.