Guides · IP & network · Updated

What is port forwarding and how do you set it up?

Port forwarding is a router rule that sends traffic arriving on one of your public ports to a specific device inside your network. It's how a game server, security camera or home server at home becomes reachable from the internet.

Why you need it

At home, all your devices share one public IPv4 address. Your router keeps track of connections your devices start, so replies find their way back. But when someone on the internet starts a connection to your public address, the router has no idea which device should get it, so it drops the traffic.

A port forwarding rule answers that question: "anything arriving on port 25565 goes to 192.168.1.50, port 25565."

How to set it up

Every router's menus look different, but the steps are the same.

  1. Give the device a fixed local address. In the router's DHCP settings, reserve an address for the device (often called DHCP reservation or static lease). Otherwise its address can change and the rule will point at nothing.
  2. Find out which port and protocol the service uses. For example SSH uses TCP 22, a Minecraft Java server TCP 25565, a web server TCP 80 and 443. The software's documentation lists them.
  3. Open the router's admin page. Usually 192.168.1.1 or 192.168.0.1; the address is often printed on the router.
  4. Find the forwarding section. It may be called Port Forwarding, Virtual Servers, NAT or Applications.
  5. Create the rule: external port, internal IP (the reserved address), internal port (usually the same) and protocol (TCP, UDP or both).
  6. Allow the port on the device itself. Windows Firewall, ufw on Linux and macOS's firewall all block inbound connections until you allow them.
  7. Test it from outside (next section).

How to test it

A test must come from the internet, not from inside your network. Many routers don't loop traffic back to your own public address, so testing from your own computer gives false results.

Check a port on your public address from our server:

Open the port checker
  • Open: the rule works and the service answered.
  • Closed: traffic reached your network but nothing was listening. The service isn't running, or the rule points at the wrong device or port.
  • Timed out: something dropped the traffic. The rule is missing, a firewall is blocking it, or your connection can't accept inbound traffic at all (see CGNAT below).

Enter your public address, which you can find on What is my IP, not the device's 192.168 address.

Why it is not working

The service only listens locally

Some programs listen on 127.0.0.1 by default, which accepts connections only from the same machine. Configure it to listen on 0.0.0.0 or the device's network address. See how to check open ports to confirm what is listening.

Double NAT

If you have your own router behind the provider's modem-router, traffic passes through two layers of address translation and you need a rule on both, or one device in bridge mode. A WAN address on your router starting with 192.168, 10 or 172.16 to 172.31 is the sign.

CGNAT: when port forwarding cannot work

Many mobile, fixed-wireless and satellite providers put customers behind carrier-grade NAT. You don't get a public IPv4 address of your own, so no rule on your router can help. Signs:

  • Your router's WAN address starts with 100.64 to 100.127.
  • The WAN address differs from the public address shown by What is my IP.

Options: ask your provider for a public or static IPv4 address (often a paid add-on), use IPv6 if both ends support it, or use a tunnel service that relays inbound traffic.

Port forwarding vs port triggering vs UPnP

  • Port forwarding keeps a port open to one device permanently.
  • Port triggering opens a port only after the device sends traffic on a related port, then closes it. Useful for some older games.
  • UPnP lets apps on your network create forwarding rules themselves. It's convenient but any program, including malware, can open ports. Turn it off if you don't need it.

IPv6: no forwarding needed

With IPv6 every device has its own public address, so there is nothing to translate. Instead you add a firewall rule on the router allowing the port to that device's IPv6 address. Read IPv4 vs IPv6 for the background.

Keeping it safe

  • Forward only the ports you need, and only to the device that needs them.
  • Never forward remote desktop (3389) or database ports straight to the internet. Use a VPN to reach them instead.
  • Keep the exposed service updated and protected by strong passwords or keys.
  • Delete rules you no longer use.

Frequently asked questions

Is port forwarding safe?

It is as safe as the service you expose. Forward only the ports you need, to a device that is patched and uses strong passwords, and remove the rule when you stop using it.

What is the difference between port forwarding and port triggering?

Port forwarding keeps a port open to one device all the time. Port triggering opens it only after that device sends traffic on another port, and closes it again afterwards.

Why is my port forwarding not working?

Common causes: the service is not running or only listens on localhost, the device's firewall blocks the port, the device's local IP changed, there is a second router in the path, or your provider uses CGNAT.

Do I need port forwarding with IPv6?

There is no NAT in IPv6, so there is nothing to forward. Instead you allow the port in your router's IPv6 firewall for that device's address.