Sky Router Port Forwarding: Sky Hub, Max Hub and MAP-T Fixes
Port forward on a Sky Broadband Hub or Sky Max Hub: Sky’s three-stage firewall rule, the My Sky app, MAP-T IP sharing (8:1 vs 1:1) and fixes when ports stay closed.
Quick Answer
On Sky Hubs up to Hub 4 and the Sky Broadband Hub (SR203/SR204), go to 192.168.0.1 > Advanced (admin and the Wi-Fi password on the hub), reserve the device under LAN IP Setup, create a service under Security > Services, then add it under Firewall Rules > Inbound Services set to ALLOW always. The Sky Max Hub (SR213) uses the My Sky app. Newer Sky lines use MAP-T IPv4 sharing: ports only open on an unshared 1:1 profile, which Sky says port forwarding, DMZ or UPnP should trigger. A port-forwarding VPN works either way.
Sky router port forwarding works differently by hub. On Sky Hubs up to the Hub 4 and the Sky Broadband Hub (SR203/SR204), it is a firewall rule: go to 192.168.0.1, open Advanced, create a service under Security > Services, then allow it under Firewall Rules > Inbound Services. The white Sky Max Hub (SR213) is set up in the My Sky app instead.
Newer Sky lines add a second hurdle: MAP-T, which shares one IPv4 address between several customers. Until your line is moved to an unshared (1:1) profile, inbound ports stay closed whatever the hub says. How to check and fix that is below, along with a VPN route that works either way. Compare Virgin Media and TalkTalk if you are switching providers.
Sky Hub Port Forwarding Settings
The model is on the hub’s label; the Sky Max Hub is the white SR213.
Sky Broadband Hub SR203 / SR204 (and Hub 4)
- Where:
- 192.168.0.1 > Advanced. Username admin; password is the default Wi-Fi password printed on the hub
- Path:
- LAN IP Setup > Address Reservation > Add; Security > Services > Add Service; Firewall Rules > Inbound Services > Add > ALLOW always
- Good to know:
- The SR204 is the G.fast version of the SR203 with the same web interface. You can create a custom service for any port or range, not just the presets.
How to Port Forward on a Sky Broadband Hub (Sky’s Steps)
- 1
Sign in to Advanced
Go to 192.168.0.1, click Advanced and log in as admin with the Wi-Fi password printed on the hub (admin / sky on older hubs).
- 2
Reserve the device’s IP
LAN IP Setup > Add under Address Reservation, select the device, note its IP and click Add. Let the hub restart if it asks.
- 3
Create a service
Security > Services > Add Service. Name it, choose TCP, UDP or both and enter the start and finish port. Repeat for every port or range the app needs.
- 4
Allow it inbound
Firewall Rules > Add under Inbound Services. Pick your service, set Action to ALLOW always, enter the device IP as Destination IPv4 LAN address and Apply.
- 5
Check MAP-T, then test
Confirm your line is not sharing its IPv4 address (next section), keep the app running, and test from outside your home.
Sky MAP-T: Why Ports Stay Closed and How to Get 1:1
MAP-T carries your IPv4 traffic over Sky’s IPv6 network and can share one public IPv4 address between several homes, each with its own slice of ports. A shared address cannot accept arbitrary inbound connections, so port forwarding fails even with a perfect rule. Sky customers report two profiles:
| MAP-T sharing ratio | What it means | Port forwarding |
|---|---|---|
| 8:1 | One IPv4 address shared by up to eight customers | Does not work for inbound connections |
| 1:1 | The IPv4 address is yours alone | Can work, if the hub rule is right |
- Check the ratio. Open the hub’s local web page and look at the connection status (on the Max Hub: Connection > Sky Network). It lists the WAN IPv4 and the MAP-T sharing ratio.
- Trigger the automatic opt-out. According to Sky, setting up a port forward, using the DMZ or enabling UPnP should move you to 1:1 automatically. Give it time, then check the ratio again.
- Still 8:1? Call Sky. Ask for MAP-T to be disabled or for an unshared IPv4. Customers report it can take several calls and days.
- Or skip the problem. A port-forwarding VPN works on shared and unshared lines alike, because the open port lives on the VPN server.
Using your own router instead of the Sky hub? Superusers note it must support the DHCP option Sky uses for IPv4 fallback (ASUS routers usually do), and you lose Sky Talk digital voice, which needs a Sky hub. See ASUS port forwarding.
Sky Port Forwarding Not Working? Check These
MAP-T is still 8:1
The service exists but no inbound rule
The preset is missing a port
Max Hub rules have no effect
Another firewall on the PC
The checker says closed
Check the result with our NAT checker from outside your network, or work through the full port forwarding not working checklist.
Open a Port Without Sky’s Router: Port-Forwarding VPN
If your line is stuck on a shared MAP-T address, the Max Hub ignores your rules, or you do not want to wait for Sky to opt you out, a VPN with port forwarding gives you an open public port that does not depend on the hub or on MAP-T. Your PC opens an outbound tunnel, which MAP-T allows, and the VPN server forwards a port back down it.
Proton VPN
- Port forwarding on all paid plans (Windows, Linux; macOS in early access)
- Works on MAP-T shared lines and with the Sky Max Hub
- One random port; it usually changes when you reconnect
- Keeps your Sky IP out of torrent swarms and game lobbies
- 30-day money-back guarantee
2-year plan
PureVPN
- Open all ports in one click, or add specific ports up to 15 at a time
- No need to wait for Sky’s MAP-T opt-out
- Optional dedicated IP that stays the same between sessions
- Apps for Windows, macOS, Linux and routers
- 31-day money-back guarantee
5-year plan·$1.69/mo $12.95/mo
This page contains affiliate links. If you sign up through them, NAT Checker may earn a commission at no extra cost to you.
Rule of thumb: if the app lets you type in any port (qBittorrent, Soulseek), Proton’s random port is enough. If the server needs a fixed port or a range (Minecraft 25565, Arma 3 2302–2306, an NVR), choose PureVPN. NordVPN, Surfshark and ExpressVPN do not forward ports; more providers are compared in our VPN port forwarding guide.