How to Set Up Port Forwarding (Step by Step)

To set up port forwarding, give the target device a fixed local IP address, create a rule in your router that sends a chosen external port and protocol to that device's IP and port, allow the port in the device's own firewall, and then test it from outside your network. It only works if your router has a real public IPv4 address, so check for CGNAT first.

Port forwarding lets a connection that starts on the internet reach a specific device behind your router, such as a game server, camera or self-hosted app. Your router normally drops unsolicited inbound traffic because it does not know which device it is for; a forwarding rule tells it. This guide covers each step, then testing, troubleshooting and security.

Before you start: check you have a public IP

Port forwarding on your router is pointless if the router itself is not directly reachable from the internet. Do this two-minute check first:

1. Note the public IPv4 address shown on the WhatsMyIPNumber homepage.
2. Log in to your router and find the WAN or internet IPv4 address on its status page.
3. If they match, you can continue. If the router's WAN address starts with 100.64 to 100.127, you are behind carrier-grade NAT. If it is a private address such as 192.168.x.x or 10.x.x.x, there is either CGNAT or a second router in front of yours (double NAT). Both are covered in the troubleshooting section below.

Step 1: Give the device a fixed local IP

A forwarding rule points at a local IP address. If your device gets a different address from DHCP next week, the rule silently breaks. Fix the address with a DHCP reservation:

1. Find the device's current IP and MAC address. On Windows run ipconfig /all; on macOS or Linux run ip addr or ifconfig; on consoles look in the network settings.
2. In the router, open the DHCP or LAN settings and look for "Address reservation", "Static lease" or "DHCP binding".
3. Bind the device's MAC address to an IP, for example 192.168.1.50, and save.
4. Reconnect the device and confirm it received the reserved address.

Alternatively, set a manual static IP on the device, choosing an address outside the router's DHCP pool. Our guide to how DHCP works explains pools, leases and reservations in detail.

Step 2: Create the forwarding rule

Log in to the router's admin page, usually at the default gateway address such as 192.168.1.1. Look for a menu called Port Forwarding, Virtual Servers, NAT, Applications or Gaming; it is often under Advanced or Firewall. Every router labels the fields slightly differently, but they map to the same concepts:

Check the application's documentation for its ports and protocols; many games need a UDP range as well as a TCP port. Using a different external and internal port (for example external 2222 to internal 22) is allowed and is sometimes the only option when two devices need the same service port. Our list of common network ports covers the usual defaults.

Step 3: Allow the port in the device's firewall

The router now delivers the traffic, but the device's own firewall may still block it.

Windows

Windows usually prompts the first time an application listens on the network; choose to allow it on the appropriate network type. To add a rule explicitly, run PowerShell as administrator:

New-NetFirewallRule -DisplayName "Minecraft TCP 25565" -Direction Inbound -Protocol TCP -LocalPort 25565 -Action Allow

Or use Windows Defender Firewall with Advanced Security → Inbound Rules → New Rule → Port. Note that rules apply per network profile; if Windows classifies your home network as Public, a rule limited to the Private profile will not apply.

Linux with ufw

sudo ufw allow 25565/tcp
sudo ufw status verbose

Check the application is listening

The service must listen on the LAN address or on all interfaces, not just 127.0.0.1:

sudo ss -tlnp | grep 25565

On Windows, use netstat -ano | findstr :25565 in Command Prompt.

A line showing 0.0.0.0:25565, [::]:25565 or 192.168.1.50:25565 is good. 127.0.0.1:25565 means only the device itself can connect.

Step 4: Test from outside

With the application running, enter the port in our open port checker. It connects to your public IP from the internet, which is the only reliable test. Keep in mind:

• The checker tests TCP only. UDP has no handshake, so to test a UDP-only service, use the client application from an outside connection such as mobile data.
• A port shows as closed if nothing is listening, even when the rule is correct. Start the service before testing.
• Testing your public IP from inside your own network depends on the router supporting NAT loopback (hairpin NAT). Many do not, so a failed test from inside proves little.

Troubleshooting a port that stays closed

CGNAT

If your router's WAN address is in 100.64.0.0/10 or a private range and there is no second router at home, your ISP is sharing your IPv4 address with other customers. No setting on your router can open a port on the ISP's NAT. Ask the ISP for a public IPv4 address, use IPv6, or use an outbound tunnel.

Double NAT

If you have an ISP modem-router plus your own router, there are two NATs. Fix it in one of these ways:

• Put the ISP device in bridge or modem-only mode, so your own router gets the public IP.
• Forward the port on the ISP device to your router's WAN IP, and again on your router to the final device.
• Set your router's WAN IP as the DMZ host on the ISP device, then forward ports only on your own router.

Other common causes

• The device's IP changed because no reservation was made.
• Wrong protocol, such as a TCP rule for a UDP service.
• ISP port blocking. Some residential ISPs block inbound ports such as 25, 80 or 445. Try a high port like 8443 to test.
• Port clash with the router, for example forwarding 443 when the router's remote management also uses it.

UPnP: automatic port forwarding

Universal Plug and Play (UPnP IGD) and the similar NAT-PMP/PCP protocols let applications ask the router to open ports for themselves. Consoles and game launchers rely on them to get an "open" NAT type.

• Pros: no manual setup; ports are opened only while the application runs; works for software that picks random ports.
• Cons: any program on your network, including malware or a compromised smart device, can open ports without asking you. Some router UPnP implementations have had serious vulnerabilities, and you lose a clear record of what is exposed.

A reasonable middle ground is to leave UPnP off and create manual rules, or, if you need UPnP for gaming, check the router's UPnP mapping table periodically.

Security best practices

• Forward only what you need, to one device, and delete rules you no longer use.
• Never expose management services such as Remote Desktop (3389), SMB (445), router admin pages or camera admin panels directly. These are scanned and attacked constantly. Use a VPN into your network instead.
• Avoid the DMZ host setting for ordinary devices; it forwards every unrequested port to them.
• Keep the exposed software updated and use strong, unique passwords or key-based authentication.
• Restrict sources where your router supports it, if only a few known addresses need access.
• Changing to a non-standard port reduces log noise from automated scans but is not real protection.

Frequently asked questions

Is port forwarding safe?

It is as safe as the service you expose. Forwarding a port to an up-to-date game server with no admin interface carries little risk; forwarding a port to an old camera or a Remote Desktop session invites attacks. Expose as little as possible and patch what you do expose.

Do I need port forwarding with IPv6?

No address translation is needed, because each device has a global IPv6 address. You still need to allow the inbound connection in the router's IPv6 firewall, which most routers call a firewall exception or pinhole rather than port forwarding.

Why does the port checker say closed when my rule is correct?

The most common reasons are that the application is not running or is bound to 127.0.0.1, the host firewall is blocking it, the service uses UDP, or you are behind CGNAT or double NAT.