Your router protects your home network by blocking connections that start from the internet. That is exactly what you want most of the time – but it also stops your friends joining your game server, prevents you reaching your NAS or security camera while travelling, and breaks some peer-to-peer apps. Port forwarding is the controlled exception: it tells your router to pass incoming traffic on a specific port to a specific device. This guide explains the concepts and walks you through setting it up safely.
Ports in one minute
An IP address gets traffic to the right device; a port number gets it to the right program on that device. Ports range from 0 to 65535. Web servers listen on port 80 and 443, SSH on 22, Remote Desktop on 3389, a Minecraft Java server on 25565, Plex on 32400. Traffic uses one of two protocols: TCP (reliable connections – web, SSH, most game servers) or UDP (fast, connectionless – voice, many games, WireGuard VPN).
Why you need port forwarding
All your devices share one public IP through NAT (see public vs private IP addresses). When a connection arrives at your public IP on, say, port 25565, the router has no idea which device should receive it, so it drops it. A port forwarding rule answers that question: “send anything arriving on TCP port 25565 to 192.168.1.50, port 25565”.
Before you start: check for CGNAT
Log in to your router and find the WAN or Internet IP address on its status page. Compare it with the public IP on our home page.
- They match: great – port forwarding will work.
- They differ, or the WAN IP starts with
100.64–100.127,10.,172.16–172.31or192.168.: your provider (or another router) is doing NAT in front of you. Port forwarding on your router alone will not work. Read What is CGNAT? for your options.
Step 1: Give the device a fixed local IP
Port forwarding rules point at a local IP address. If the device gets a different address from DHCP after a reboot, the rule breaks. Fix it with a DHCP reservation:
- Open your router’s admin page – usually
192.168.1.1,192.168.0.1or10.0.0.1(it is your “default gateway”). - Find LAN, DHCP, Address reservation or Connected devices.
- Select the device and choose “Reserve IP” or “Always use this IP”, or add its MAC address manually with an address of your choice.
- Reconnect the device and confirm it receives the reserved address.
Alternatively, set a static IP on the device itself, choosing an address outside the router’s DHCP pool so nothing else gets it.
Step 2: Allow the program through the device’s firewall
Windows Defender Firewall, macOS and Linux firewalls block unknown incoming connections. When you first start a server, Windows usually asks whether to allow it – choose Allow for private networks (and public if needed). You can also add a rule in Windows Security › Firewall & network protection › Allow an app through firewall. On Linux, open the port with your firewall tool, for example sudo ufw allow 25565/tcp.
Step 3: Create the forwarding rule
Every router brand names this differently: Port Forwarding, Virtual Servers, NAT Forwarding, Applications & Gaming, Firewall › Port rules or Pinholes. You usually find it under Advanced settings. Fill in:
| Field | What to enter | Example |
|---|---|---|
| Name / Service | Anything descriptive | Minecraft |
| Protocol | TCP, UDP or both – check the program’s documentation | TCP |
| External (WAN) port | The port people connect to from the internet | 25565 |
| Internal (LAN) IP | The reserved address from step 1 | 192.168.1.50 |
| Internal port | The port the program listens on (usually the same) | 25565 |
Save and apply. Some routers need a restart. If your router has UPnP enabled, some games and apps create these rules automatically; it is convenient, but many people prefer to turn UPnP off and create rules manually for better control.
Step 4: Test it
- Make sure the program is running – a port only shows open when something is listening.
- Use our port checker to test the external port on your public IP.
- Open means it works. Closed means the router forwarded the connection but nothing accepted it (program not running, wrong internal port, or device firewall). Filtered means nothing answered – the rule is missing, points to the wrong device, the provider blocks the port, or you are behind CGNAT.
- Finally, ask someone outside your network to connect using your public IP and the port. Testing from inside your own network using the public IP needs a router feature called “NAT loopback” or “hairpinning”, which not every router supports.
Troubleshooting checklist
- Is the device’s local IP still the one in the rule?
- Is the protocol right? Many games need UDP as well as TCP.
- Do you have two routers (for example, the provider’s modem-router plus your own)? Then you need forwarding on both, or put the provider’s device into bridge/modem mode.
- Does your provider block the port? Some block 25, 80 or 445 on home lines – try a different external port that forwards to the same internal port.
- Has your public IP changed? Use dynamic DNS so people can always find you by name.
- Using IPv6? Port forwarding is an IPv4 concept. For IPv6, create a firewall rule that allows the port to the device’s IPv6 address.
Keep it secure
Every forwarded port is visible to the whole internet, and automated scanners will find it within hours.
- Only forward the ports you need, and remove rules you no longer use.
- Keep the software behind the port updated, and use strong, unique passwords.
- Avoid exposing Remote Desktop (3389), SMB file sharing (445), router admin pages and camera web panels directly. They are constantly attacked.
- For remote access to your home network, consider a VPN instead: forward a single UDP port to a WireGuard server (many routers and NAS devices include one), then reach everything else through the tunnel.
- Check your router’s firmware for updates regularly.
Summary
Port forwarding tells your router which local device should receive incoming traffic on a port. Reserve a local IP for the device, allow the program through its firewall, create the rule on the router, and test with our port checker. If nothing works despite correct settings, check for CGNAT – and always forward as little as possible.