AT&T Port Forwarding: BGW320, BGW620, and BGW210 Guide
Match your AT&T port forwarding problem to the right fix, set up NAT/Gaming on BGW320, BGW620, and BGW210 gateways, and reach your services with IP Passthrough or a port-forwarding VPN.
Hi there! AT&T gateways look friendly, but port forwarding on them trips up almost everyone I hear from: the NAT/Gaming page hides behind a Device Access Code, a saved service silently does nothing until you assign it, and Internet Air or a personal router can block the whole plan. I built NAT Checker while working through these same walls on my own home lab, and this guide is the shortcut I wish I had back then. Find your situation in the table below, then follow the matching method.
Find Your AT&T Situation and Next Step
Do not change gateway settings at random. Match your situation to the next action first — each row points to the exact step or method below.
| Your situation | What it means | What to do next |
|---|---|---|
| First port forward | You need a game, media server, or camera reachable from the internet on a BGW320, BGW620, or BGW210. | Use Method 1: create a custom service in NAT/Gaming and assign it under Needed by Device. |
| Saved but closed | The service exists in NAT/Gaming, but an outside port checker still reports the port as closed. | Creating a service does not attach it. Go to Method 1, step 5, and assign it under Needed by Device. |
| Wrong internal port | Traffic seems to arrive, but the wrong application answers or nothing listens on the destination. | Set Base Host Port to the application's listening port. See Method 1, step 4. |
| Own router / Double NAT | A personal router sits behind the AT&T gateway and blocks inbound traffic before it reaches your device. | Configure IP Passthrough so your router owns the public path. See Method 1, step 7. |
| Gateway page won’t open | http://192.168.1.254 does not load while you are connected to your network. | Connect directly to the AT&T gateway instead of another router, and check the default gateway address in your device's network settings. |
| Internet Air / no public IPv4 | You are on Internet Air or 5G Home Internet, or the gateway WAN address sits in the shared 100.64.0.0/10 CGNAT range. | AT&T CGNAT leaves no inbound path. Use Method 2: a VPN with port forwarding. |
| Everything looks right | The rule, assignment, and local service are all correct, but the port still tests closed from outside. | Compare the gateway broadband IPv4 with your public IP, then use Method 2 if the two addresses differ. |
Method 1 is free if you can change your router settings. Method 2 uses a paid VPN, but it is simpler and more convenient if you cannot—or do not want to—change the router.
Method 1: Port Forward Through the AT&T Gateway
Use this method when you can open http://192.168.1.254 and change gateway settings. Follow the steps in order — the assignment step is where most AT&T port forwards silently fail.
Open the AT&T gateway page
Connect to the AT&T gateway's WiFi or LAN and browse to http://192.168.1.254. If it does not open, you are probably behind another router — check the default gateway address in your device's network settings.
Open Firewall > NAT/Gaming
Sign in and choose Firewall, then NAT/Gaming. The BGW320, BGW620, and BGW210 all use this area; older gateways may call it Applications, Pinholes and DMZ.
Enter the Device Access Code
AT&T asks for the Device Access Code printed on the gateway label — not your WiFi password. If the label code was changed before, use the current custom code.
Create or pick the service
Choose a matching preset, or open Custom Services and enter a Service Name, Global Port Range, Base Host Port, and protocol. For a single-port forward, set both port fields to the same number, then save the service.
Minecraft Java example
TCP 25565Minecraft Bedrock example
UDP 19132Assign it under Needed by Device
Back on the main NAT/Gaming screen, select the saved service, pick the computer, console, or server under Needed by Device, and click Add. This is the step most often missed — a service that is never assigned forwards nothing.
Save, then test from outside
Start the application, confirm it works from another device on your home network, and test the port from cellular data using the gateway's current public IPv4 address.
If Gateway Rules Do Nothing, Look Upstream
Two things ahead of your device can silently discard inbound traffic: a second router doing its own NAT, and AT&T address sharing that leaves you without a usable public IPv4. Remove the first with IP Passthrough, and confirm the second with a quick check before spending more time on gateway settings.
Set up IP Passthrough for your own router
Under Home Network > Subnets & DHCP, set IP Passthrough to DHCPS-fixed with your router's MAC address. Your router then receives the public IPv4 and owns the inbound path — keep port rules there, not on both boxes.
Check for Double NATConfirm you actually have a public IPv4
Compare the IPv4 address on the gateway's broadband status page with the public IP reported by an outside checker. If the two differ — or you are on Internet Air — no gateway rule can accept inbound traffic.
Check for CGNATDo not stack every workaround
Common AT&T Port Forwarding Presets
Enter these values as the Global Port Range and Base Host Port in a custom service, then assign the service to the device running the application. The vendor decides the final requirement, so confirm against the app documentation.
| Application | Ports to open | Setup note |
|---|---|---|
| Minecraft (Java Edition) | TCP 25565 | Same-port forward: set Global Port Range and Base Host Port to 25565. |
| Minecraft (Bedrock) | UDP 19132 | Consoles and mobile Bedrock clients reach the server on this port. |
| Palworld | UDP 8211 | Host players connect through the dedicated server port. |
| Valheim | UDP 2456-2458 | Enter 2456-2458 as the Global Port Range and 2456 as the Base Host Port. |
| Plex Media Server | TCP 32400 | Remote streaming needs this port plus the app's relay fallback. |
| IP camera / NVR (RTSP) | TCP 554 + vendor app port | RTSP is standard; the vendor app port (Lorex, Reolink, and so on) varies by model. |
| Xbox Live | TCP 3074; UDP 88, 500, 3074, 3544, 4500 | Create one custom service per protocol if no preset covers both. |
| PlayStation Network | TCP 3478-3480; UDP 3074 | Enter 3478-3480 as the range and 3478 as the Base Host Port. |
Method 2: Use a VPN With Port Forwarding When AT&T Blocks the Path
Use this method when IP Passthrough cannot remove Double NAT, Internet Air or CGNAT leaves you without a public IPv4, or you cannot touch the gateway settings at all. A VPN with explicit incoming-port support gives your service a reachable address on the VPN's network — no AT&T changes required.
Choose a VPN That Actually Opens Ports
Proton VPN
- Port Forwarding on paid plans assigns one incoming port.
- Point Plex, a game server, or P2P traffic at the assigned port.
- Proton's ecosystem has more than 100 million users.
- 30-day money-back guarantee.
PureVPN
- Paid All-Port Forwarding add-on opens dedicated incoming ports.
- Host without gateway access, even behind Internet Air CGNAT.
- PureVPN has more than 3 million users.
- 31-day money-back guarantee.
Which Fix Fits Your Setup?
| Your situation | Best method | Why |
|---|---|---|
| First port forward, gateway within reach | Method 1 | It is free and uses the NAT/Gaming workflow AT&T built for exactly this. |
| Personal router behind the gateway | Method 1: IP Passthrough | One NAT layer instead of two makes every other rule behave predictably. |
| Service saved but the port tests closed | Method 1, step 5 | An unassigned service forwards nothing; assigning it fixes most 'not working' reports. |
| Internet Air or 5G Home Internet | Method 2: VPN | Carrier-grade NAT leaves no public IPv4, so no gateway rule can accept inbound traffic. |
| Rented home or managed router, no admin access | Method 2: VPN | The tunnel opens your port from a server you control, not from the AT&T box. |
| Regular game or Plex hosting with friends | Method 2: Proton VPN | One assigned port covers join-from-outside without touching gateway settings. |
| Specific ports or ranges for a home lab | Method 2: PureVPN | All-Port Forwarding opens dedicated ports without entering each rule on the gateway. |
Before You Change Anything
- Forward only the port or narrow range the application documents — do not open a wide range to save time.
- Keep the device firewall on and add a matching inbound rule for the same protocol and port.
- Remove rules you no longer use, and never park a computer or console in DMZ as a shortcut.
- Treat the Device Access Code like a password, and do not leave the gateway page open on shared devices.
AT&T Port Forwarding FAQ
Not Sure Which NAT Problem You Have?
Run the NAT Checker from your home network and it will tell you whether you are behind CGNAT or Double NAT, and whether your public IP is usable. Then come back to the table above and pick the matching method.
Check NAT Type Now →