How do I configure my router to forward a port?

Reserve a local IP for the destination device, open the router's Port Forwarding, NAT, Virtual Server, or Port Mapping page, then enter the required protocol, external port, destination local IP, and internal port. Save the rule and test while the service is running.

Is Windows port forwarding the same as opening Windows Firewall?

No. A home router rule sends internet traffic to the Windows PC. A Windows Firewall rule then permits that traffic on the PC. Most home-hosting setups need both, but they are separate controls.

Can I do port forwarding without router access?

Usually not for a normal home IPv4 connection. The device that owns the public IP must accept and map the inbound traffic. Without access, use automatic UPnP if the app and router support it, ask the administrator or ISP, or use a trusted relay or tunnel designed for inbound connections.

Should internal and external ports be the same?

Usually yes. Using the same number is simpler and works for applications that advertise or expect a fixed port. Change the external number only when the application and remote clients support that mapping.

Do I enter the port in both start and end fields?

Yes for one port. Enter the same number as the start and end. Use a range only when official application documentation requires every port in that range.

Is port forwarding safe?

It can be safe when the exposed service is maintained, authenticated, and limited to the exact required port. It increases exposure, so avoid forwarding administration panels, file shares, or remote desktop directly to the internet unless they are specifically hardened for it.

Why does a port checker say closed after I forwarded it?

The service may be stopped, listening on a different interface or protocol, blocked by the device firewall, targeted by an outdated local IP, or unreachable because of Double NAT or CGNAT. Test local access first, then work outward one layer at a time.

Do I put my public IP in the port forwarding rule?

No. The destination field needs the device's local IPv4 address, such as 192.168.1.50. Remote users connect to the router's public IP; the router already knows that address on its WAN interface.

Guide

14 min readJul 27, 2026

How to Do Port Forwarding on Any Router

Create and test the right router rule, then diagnose firewall, Double NAT, or CGNAT failures.

Quick answer

Give the destination device a stable local IP, then map the required external TCP or UDP port to that IP and the service's internal port. Allow the traffic through the device firewall and test from another network. If the router's WAN IP is private or in 100.64.0.0/10, fix the upstream NAT or get a public IPv4 address first.

Blocked by CGNAT or no router access? See VPN options

Plan your port forwarding rule

Enter the values your app, game, camera, or server requires. This planner does not change your router; it turns the details into a field-by-field rule you can copy.

Rule nameDevice local IPExternal portInternal port

Protocol

Router rule

Name / description: Home server
Protocol: TCP
External / public / start-end port: 25565
Internal IP / device IP: 192.168.1.50
Internal / private / destination port: 25565
Source: Any (leave blank unless access must be limited)

Use the port required by the app's official documentation. Do not guess or forward a large range when one port is enough.

Before you open the router settings

Confirm the service works locally

Start the app or server and connect to it from another device on the same home network. A router cannot forward traffic to a service that is stopped or listening on a different port.

Get the exact port and protocol

Find the official port number and whether it uses TCP, UDP, or both. TCP and UDP are separate rules on routers that do not offer a combined option.

Find the device's local IPv4 address

Use the address assigned inside your home, usually beginning with 192.168, 10, or 172.16-31. Do not put your public IP in the internal IP field.

Find the router address and sign-in

The default gateway shown by your device is normally the router address. Open it in a browser and use the router administrator credentials, not the Wi-Fi password unless they are the same.

Find your local IP and router address

Use the instructions for the device that will receive the forwarded traffic.

Windows 10 or Windows 11

Open Command Prompt, run ipconfig, then note IPv4 Address and Default Gateway under the active Ethernet or Wi-Fi adapter.

ipconfig

macOS

Open System Settings > Network, select the active connection, then Details > TCP/IP. Note the IPv4 address and Router value.

Linux

Run ip -4 addr to find the local IPv4 address and ip route | grep default to find the default gateway.

ip -4 addr
ip route | grep default

Game console, camera, or other device

Open the device's network status page, or check the router's connected-device list. Match the name and MAC address so you do not forward to the wrong device.

How to do port forwarding on a router

Reserve the destination device's local IP

In the router's DHCP or LAN settings, reserve the current local IP for the device. A reservation prevents the rule from breaking when the router assigns a different address later.

Sign in to the router

Enter the default gateway address in a browser. Common router addresses include 192.168.0.1 and 192.168.1.1, but use the gateway your device reports instead of guessing.

Open the port forwarding page

Look under Advanced, NAT, Firewall, Security, Virtual Server, Applications & Gaming, or Port Mapping. These labels describe the same type of inbound mapping.

Create the rule

Enter a recognizable name, the required protocol, the external port, the destination device's local IP, and the internal port. Use the same number internally and externally unless the application explicitly supports a different mapping.

Allow the traffic on the destination device

Allow the app or create a narrow inbound firewall rule for the same protocol and internal port. Avoid turning the firewall off as a permanent fix.

Save, apply, and test from outside

Keep the service running and test from mobile data or another internet connection. Connecting to your own public IP while still on home Wi-Fi can fail on routers without NAT loopback even when outside access works.

What each router field means

Router label	What to enter
Name, service, or description	Any short label that identifies the app or device
External, public, WAN, or start/end port	The port remote users connect to
Internal, private, LAN, or destination port	The port the service listens on; usually the same number
Internal IP, server IP, or device IP	The destination device's stable local IPv4 address
Protocol	TCP, UDP, or separate rules for both, as required
Source IP or remote host	Leave blank or Any unless you want to restrict who can connect

Port forwarding example

Suppose a TCP service listens on port 25565 at 192.168.1.50. The complete path is:

Remote user

Router public IP:25565

192.168.1.50:25565

The router changes the destination from its public address to the local device. It does not start the service, choose its port, or bypass the device firewall.

How to test port forwarding correctly

1Keep the service listening

Most port checks report closed when no application is listening. Start the actual service before every test.

2Use a real outside connection

Turn off Wi-Fi on a phone and use mobile data, or ask someone outside your home to connect. For UDP, use the application itself when possible because a generic scanner may not get a reply.

3Connect to the public address

Remote users connect to your current public IP or a hostname that resolves to it, followed by the external port when the application requires one.

4Interpret the result in layers

Local failure points to the service or device firewall. Local success plus outside failure points to the router rule, upstream router, ISP, CGNAT, or stale public IP.

Check the NAT behavior of your current connection before changing more router settings.

Run the NAT test

Why is my port still closed?

Check these in order. Changing several settings at once makes the real cause harder to find.

What you see	Likely cause	What to do
It does not work on the home network	Service stopped, wrong port, or device firewall	Fix local access before testing the router
It worked, then stopped later	The device received a new local IP	Add a DHCP reservation and update the rule
The rule looks right but the app times out	TCP/UDP mismatch or wrong port range	Match the app's documented protocol exactly
Public-IP test fails only from home Wi-Fi	The router does not support NAT loopback	Retest from mobile data or another network
Router WAN IP is a private address	Double NAT or an upstream gateway	Bridge the upstream gateway, use AP mode, or forward on both routers
WAN IP is 100.64.0.0-100.127.255.255	Carrier-Grade NAT	Request a public IPv4 address or use an inbound-capable relay/tunnel
Everything matches but outside access still fails	ISP filtering, VPN, security software, or stale public IP	Disable conflicting VPN routes, check ISP policy, and confirm the current public IP

Check Double NAT and CGNAT before repeating the rule

Compare the WAN or Internet IPv4 address shown by your router with your public IPv4 address. A private WAN address usually means another router is upstream. An address from 100.64.0.0/10 points to shared ISP space. In either case, an unsolicited connection never reaches your router until the upstream layer is changed or configured too.

Review router NAT settings Run the CGNAT checks Check for Double NAT

Alternative when router forwarding is blocked

Use a VPN with port forwarding support

If CGNAT, ISP filtering, or missing router access prevents a normal rule, a VPN that explicitly supports incoming port forwarding can provide another path to your device. Connect the host to the VPN, then configure the app to use the port assigned by the provider.

Most VPNs do not accept incoming connections

A standard VPN does not open ports or change your home router's NAT. Before paying, confirm current port forwarding availability, supported locations and devices, whether the provider assigns the port, and whether TCP or UDP matches your application.

PureVPN

Offers port forwarding as an add-on for users who need to open selected ports through the VPN connection.

Check availability

Private Internet Access

Provides an assigned forwarded port on supported VPN locations, with availability depending on the server and app.

Check availability

Proton VPN

Supports port forwarding on eligible paid plans and platforms through selected P2P servers.

Check availability

Compare VPN, router, and relay options

Port forwarding safety

A forwarded port exposes one listening service to the internet. Treat the service as public-facing.

Forward only the exact ports and protocols you need.
Keep the router, operating system, and exposed application updated.
Use strong authentication and disable anonymous or default accounts.
Prefer a source-IP restriction or a VPN for private administration panels.
Do not use DMZ host as a shortcut for a single-port problem.
Delete old rules when the game, server, or device no longer needs them.

Port forwarding questions

Authoritative references

Protocol registries and operating-system guidance used for the technical details above.

Share this article