Eero Port Forwarding: App Setup and Troubleshooting Guide
Create an IPv4 reservation in the eero app, add the correct TCP or UDP port, test from outside your Wi-Fi, and fix Double NAT or CGNAT problems.
Quick Answer
In the eero app, open Settings > Advanced networking > Reservations & port forwarding. Reserve the destination device first, open that reservation, choose Open a port, enter the required single port or range, select TCP, UDP, or Both, and save. Keep the service running and test from cellular data or another outside network. If the eero WAN address is private or shared, fix Double NAT or CGNAT before repeating the local rule.
No public IPv4 or router access? Compare VPN optionsPlan Your Eero Port Rule
Enter the device and port requested by your game, server, camera, NAS, or remote-access app. The planner creates a field-by-field reference for the eero app.
Reference only: enter these values manually in the router, application, or VPN client. Copying them does not import or apply the settings.
Eero Port Forwarding Settings at a Glance
Eero attaches a port rule to a reserved device. That relationship matters: a correct port aimed at yesterday's device address will still fail.
| Setting | What to enter | Why it matters |
|---|---|---|
| App location | Settings > Advanced networking | Reservations & port forwarding is managed in the eero mobile app rather than a traditional router web page. |
| Destination device | IPv4 reservation | The reservation keeps the same local IPv4 address assigned to the device after reconnects and restarts. |
| Protocol | TCP, UDP, or Both | Match the application's documentation. Both is useful only when the service actually listens on both protocols. |
| Port value | Single port or range | Use a hyphen for a documented range, for example 3478-3480. Do not expose a wider range than the service requires. |
How to Port Forward on an Eero Router
The labels can vary slightly by eero app version, but the reservation-first workflow is the same across current eero, eero 6, Pro 6, and Pro 6E networks.
Open Advanced networking in the eero app
Connect your phone to the eero network, open the eero app, choose Settings, then Advanced networking and Reservations & port forwarding. Make sure you are editing the correct eero network if your account manages more than one location.
Reserve the destination device's IPv4 address
Choose Add a reservation, select the device that runs the service, and save it. Verify the device name and current IPv4 address instead of selecting a similarly named old or offline device.
Open the reservation and add a port
Select the reserved device and choose Open a port. Give the rule a recognizable name, such as Plex, Minecraft Server, NAS HTTPS, or PS5 Voice, so it is easy to audit later.
Enter the exact port and protocol
Enter the single port or documented range and choose TCP, UDP, or Both. A port number alone is not enough: forwarding TCP does not automatically forward UDP on the same number.
Save and confirm the rule remains attached
Save the rule, return to the reservation list, and confirm the device and port appear together. Restart the app or service if it only binds its listening port during startup.
Test from outside the eero Wi-Fi
Keep the destination service running and test from cellular data or another internet connection. Testing your public address while still on the same Wi-Fi can fail when local loopback is unavailable even though real outside access works.
Test the Eero Rule Correctly
A port checker can only report open when a service is actively accepting the tested protocol at that moment. Use this order before changing the rule again.
Start the game server, media server, camera, or other app first and confirm it works from another device on the home network.
Turn off Wi-Fi on a phone or use a separate connection. Do not treat a same-network public-IP test as final proof.
Use the current public IPv4 address. If it differs from the eero WAN address, investigate an upstream router or CGNAT.
Test the exact protocol. Many browser-based port checkers test TCP only and cannot prove that a UDP service is reachable.
Eero Port Forwarding Not Working
Use the symptom to decide what to inspect. Recreating the same eero rule will not fix an offline listener, the wrong device, or an upstream address-sharing layer.
| Symptom | Likely cause | What to do |
|---|---|---|
| The rule exists but reaches the wrong device | An old device entry was reserved, or the service moved to another computer or console. | Compare the device's current IPv4 address and MAC address with the reservation, then recreate the reservation only if they do not match. |
| The port always looks closed | Nothing is listening, the service is bound only to localhost, or the device firewall is blocking it. | Confirm local-network access first, bind the service to the LAN interface, and allow the same protocol and port through the device firewall. |
| TCP works but the app still fails | The application also requires UDP, or the forwarded protocol does not match its documentation. | Add only the missing documented protocol. Do not assume a TCP-only web checker can validate UDP. |
| Eero is connected behind an ISP gateway | Both the gateway and eero are routing, so unsolicited traffic stops at the first NAT layer. | Put the upstream gateway in bridge or passthrough mode, bridge the eero only when another router must remain primary, or forward the same port through both layers. |
| The eero WAN address is shared or does not match public IPv4 | The ISP is using CGNAT or another upstream NAT that you cannot configure. | Ask the ISP for a public IPv4 address, use an application relay, or choose a VPN or tunnel that explicitly provides incoming port forwarding. |
| The app uses IPv6 but the IPv4 rule changes nothing | IPv6 reachability is controlled by firewall rules rather than an IPv4 NAT mapping. | Treat IPv6 separately, allow only the documented inbound traffic, and do not disable the IPv6 firewall broadly. |
Double NAT, Bridge Mode, and CGNAT on Eero
Compare the eero WAN IPv4 address with the public IPv4 shown by NAT Checker. A private WAN address such as 192.168.x.x, 10.x.x.x, or 172.16-31.x.x usually points to another local router. An address in 100.64.0.0/10, or a different public-looking address that you do not control, can indicate CGNAT. Bridge or passthrough mode can remove local Double NAT; it cannot remove ISP-level CGNAT.
When a VPN Can Replace Eero Port Forwarding
A VPN is a fallback when you cannot obtain a public IPv4 address, cannot change the upstream router, or need an application-specific incoming port. It does not repair the eero rule or change the NAT behavior of your home router. The VPN service must explicitly support port forwarding, and the app must use the port assigned by that service.
A normal VPN connection without incoming port support will not make a home service reachable. For a camera, NAS, or Plex server, confirm that the provider can route an incoming port to the device and that the application can use the assigned public port.
PureVPN
A possible option when you need an incoming port add-on and cannot get a public IPv4 from the ISP. Confirm device and plan support before setup.
Check availabilityPrivate Internet Access
Provides port forwarding in supported regions. The application must use the port assigned by the VPN client rather than an arbitrary eero rule.
Check availabilityProton VPN
Supports port forwarding on eligible plans and platforms. Use the provider-assigned port and keep the VPN connection active.
Check availabilityEero Port Forwarding Safety
- Forward only the documented port or range. Avoid broad ranges added merely to make troubleshooting easier.
- Keep the reservation tied to the intended device and remove stale rules when that device is retired or repurposed.
- Keep the destination operating system and application firewall enabled; allow only the service that must receive traffic.
- Do not place a computer, NAS, or console in DMZ as a shortcut for a missing port rule.
Eero Port Forwarding FAQ
Where is port forwarding in the eero app?
Open Settings > Advanced networking > Reservations & port forwarding. Create or select an IPv4 reservation for the destination device, then choose Open a port.
Can eero port forward a range of ports?
Yes. Enter a documented range with a hyphen, such as 3478-3480. Keep it as narrow as possible and select the protocol required by the application.
Should I choose TCP, UDP, or Both on eero?
Choose the protocol listed by the game or application. Use Both only when it requires both TCP and UDP on the same port or range.
Why is eero port forwarding not working?
The most common causes are an offline service, the wrong reserved device, a local firewall, the wrong protocol, an ISP gateway creating Double NAT, or CGNAT preventing unsolicited inbound IPv4 traffic.
Do I need bridge mode for eero port forwarding?
Not when eero is the only router. Bridge or passthrough mode becomes relevant when an ISP gateway or second router also performs NAT. Keep one primary routing layer whenever possible.
Does an eero IPv4 port forward open the same port on IPv6?
No. IPv6 does not use the same IPv4 NAT mapping. Inbound IPv6 access is a separate firewall decision and should be limited to the service that needs it.
Official and Technical Sources
These links document eero's controls and the shared IPv4 range used when diagnosing upstream address sharing.