whatsmyip.fyi
Tools

Home network and routers

Port forwarding

A port forward is a rule in your router that sends inbound traffic arriving on one public port to one device and port inside your network. NAT has no way to guess that destination on its own, so without the rule the connection is dropped. The rule needs a fixed internal address, and it cannot work at all if your ISP puts you behind carrier-grade NAT.

Test any rule you create from outside your network with /port-check.

Why NAT needs to be told

Your router runs network address translation, described in RFC 3022. When a device inside your network opens a connection, the router rewrites the source address to its own public one and records the mapping, so the reply comes back to the right device. That table is built from outbound traffic.

An unsolicited inbound packet has no entry. The router receives a SYN for port 25565 and has thirty devices behind it and no reason to prefer any of them, so it drops the packet. A port forward is a permanent entry added by hand: anything arriving on this public port goes to this internal address.

The IPv6 side has no translation, so there is no mapping to create. There is a firewall that blocks unsolicited inbound traffic by default, and you open a hole in it. Routers label this pinhole, IPv6 firewall rules, or simply firewall.

Pin the internal address first

A forward points at a fixed private address. If the device gets a new DHCP lease, the rule now points at nothing, or worse, at a different device.

Create a DHCP reservation in the router rather than setting a static address on the device. The reservation binds the MAC address to one IP inside the DHCP range, so the router stays authoritative and you avoid a duplicate-address conflict later. Look for DHCP Reservation, Address Reservation, or Static Lease in the LAN settings.

A device with MAC randomisation enabled will break this. On the device’s Wi-Fi settings, set the private address option to “use device MAC” for your home network before you take the reservation.

Creating the rule

The section is named differently on every brand:

Brand Where the setting lives
ASUS WAN, then Virtual Server / Port Forwarding
TP-Link Advanced, NAT Forwarding, Virtual Servers
Netgear Advanced, Advanced Setup, Port Forwarding / Port Triggering
Synology Control Panel, External Access, Router Configuration
UniFi Settings, Routing & Firewall, Port Forwarding
OpenWrt Network, Firewall, Port Forwards

Every form asks for the same five things: external port, internal IP, internal port, protocol, and a name. External and internal ports do not have to match, and using a different external port is a small but real reduction in automated scanning noise.

Choose TCP or UDP deliberately. Web services, SSH, and most file transfer use TCP. Game servers, WireGuard, and voice traffic often use UDP. Selecting “both” when you only need one widens the exposure for nothing.

When it does not work

Work through these in order.

  1. Read the router’s WAN address. If it starts with 100.64 through 100.127, you are behind carrier-grade NAT and no rule on your router can help. If it is 192.168.x.x or 10.x.x.x, another router sits upstream and needs its own matching rule.
  2. Confirm something is listening. On the target machine run ss -tlnp on Linux, netstat -an | findstr LISTENING on Windows, or lsof -iTCP -sTCP:LISTEN -P on macOS. A rule that forwards to a closed port shows as closed.
  3. Check the device firewall. Windows Defender Firewall blocks inbound connections for new applications by default, and a fresh Linux install with ufw enabled blocks everything but SSH.
  4. Check the internal address. Compare the address in the rule with the device’s current address.
  5. Test from outside. Your own public address seen from inside your LAN often fails because the router does not support hairpin NAT. Use /port-check or mobile data with Wi-Fi off.
  6. Check the ISP. Some block 25, 80, 443, and 445 inbound on residential lines as policy.

UPnP and the automatic alternatives

UPnP IGD and NAT-PMP let an application ask the router to open a port for itself, which is why a game console usually works with no configuration. PCP is the standardised successor.

The trade is real. Any process on your LAN can open any port without authentication, which includes anything that got onto a laptop. If you can enumerate the two or three ports you need, create them by hand and turn UPnP off. If your household runs consoles and varied software, leaving UPnP on is a defensible choice on a network you control. Review the active mappings occasionally; most routers list them.

Rules worth keeping

  • Never forward remote access protocols directly. RDP on 3389, VNC on 5900, SMB on 445, and Telnet on 23 are scanned constantly. Reach them through a VPN or a tunnel instead.
  • Never forward a database port. Postgres on 5432, MySQL on 3306, MongoDB on 27017, and Redis on 6379 belong on the LAN side of a proxy.
  • Patch what you expose. An open port is an ongoing commitment to update that software.
  • Require authentication and use TLS on anything reachable from the internet.
  • Remove rules you stopped using. Old forwards outlive the service they were created for and end up pointing at whatever now holds that address.

If you only need to reach your own network rather than serve the public, a WireGuard or Tailscale tunnel gives you access with one port open or none at all, and it works behind CGNAT where a forward does not.

Questions people ask

Why is my port forward not working?
In order of frequency: the device changed its internal IP address, the device firewall blocks the port, nothing is listening on it, a second router sits between yours and the internet, or your ISP uses carrier-grade NAT. Check the WAN address on your router first.
Should I use UPnP instead?
UPnP is convenient and lets any device on your LAN open a port without asking. That includes malware. Use it on a trusted home network if you value the convenience, and turn it off if you can create the two or three rules you need by hand.
Is port forwarding safe?
It exposes one service to the internet, so it is exactly as safe as that service. Keep the software patched, require authentication, and never forward RDP on 3389, SMB on 445, Telnet on 23, or a database port directly.
Do I need port forwarding for IPv6?
No, because there is no address translation. You need a firewall rule instead, called pinhole or IPv6 firewall on most routers, permitting inbound traffic to that address and port.

Related

Last reviewed 2026-09-04. Reviewed quarterly, or sooner when a vendor changes something.