VPN Port Forwarding in 2026: Only 5 VPNs Still Support It
We checked 11 VPNs. Only Proton, PureVPN, PIA, AirVPN and Windscribe still forward ports; NordVPN, Surfshark and ExpressVPN never did, and Mullvad and IVPN removed it. Pick by the ports your app needs.
Quick answer: Proton VPN (one port on paid plans), PureVPN (all ports or chosen ports with a paid add-on), PIA (one port outside the US) and AirVPN (reserved ports) still offer port forwarding. NordVPN, Surfshark and ExpressVPN apps do not, and Mullvad and IVPN removed it in 2023. For qBittorrent, one Proton port is enough. For a game server, several services or Open NAT, use PureVPN, and add its dedicated IP if the address must stay the same.
Your public connection path
You / CGNAT
No inbound path
VPN public port
Mapped to you
Your app
Listens inside
The public doorway moves to the VPN server, while your app stays on the device you control.
Checked October 30, 2026
Which VPNs still support port forwarding?
Many older “best VPN for port forwarding” lists still name Mullvad or IVPN, which both removed the feature in 2023. We checked 11 providers against their own documentation. Only the first five can give your app an inbound port today, and they differ in how many ports you get and whether the number stays the same.
| VPN | Port forwarding | Ports | Port number | Cost | Details |
|---|---|---|---|---|---|
| Proton VPN | Yes | 1 port, P2P servers | Random; usually changes when you reconnect | All paid plans | qBittorrent + Proton setup |
| PureVPN | Yes | All ports in one click, or chosen ports added up to 15 at a time | You pick the port numbers | Paid add-on | PureVPN setup |
| Private Internet Access | Yes | 1 port, non-US servers only | Random; refresh it after reconnecting | Included | PIA guide |
| AirVPN | Yes | Up to 5 ports at once | Reserved to your account while subscribed | Included | AirVPN guide |
| Windscribe | Limited | Ephemeral port on Pro; permanent ports need a static IP | Ephemeral port lasts 7 days | Pro plan; static IP costs extra | Windscribe guide |
| NordVPN | No | No inbound ports, including on dedicated IPs | — | — | Why not NordVPN |
| Surfshark | No | No inbound ports on any server | — | — | Surfshark status |
| ExpressVPN | No | None in the apps; Aircove router rules only cover your home IP | — | — | ExpressVPN status |
| Mullvad | Removed | Existing ports removed July 1, 2023 | — | — | Shutdown timeline |
| IVPN | Removed | All reserved ports disabled September 30, 2023 | — | — | IVPN status |
| PrivadoVPN | No | Not documented; its guide covers home-router rules only | — | — | PrivadoVPN status |
The two port-forwarding VPNs we recommend
Of the five that still forward ports, these two cover almost every job. Proton is the easy pick when one port is enough; PureVPN is the one that lets you choose the port numbers, open every port, or keep a fixed IP.
Not every VPN supports inbound port forwarding
Proton VPN
- One active forwarded port in the app for P2P and a single listening service
- Creates an inbound path through the VPN even when the home line is behind CGNAT
- Open-source apps with independently published security and no-logs audits
- 30-day money-back guarantee for eligible paid-plan purchases
2-year plan·$2.49/mo $9.99/mo
PureVPN
- Open all ports in one click, or add chosen ports up to 15 at a time
- In our test, all-ports mode turned a Symmetric NAT result into Full Cone NAT
- 3 million+ satisfied users reported by PureVPN
- 31-day money-back guarantee for eligible first purchases
5-year plan·$1.69/mo $12.95/mo
+ Port Forwarding add-on: $1.99/mo
This page contains affiliate links. If you sign up through them, NAT Checker may earn a commission at no extra cost to you.
Need the same public IP every time, for a camera, a server address friends saved or an allowlist? A shared VPN IP changes when you reconnect. PureVPN sells a dedicated IP that keeps the forwarded ports on one address; see VPN with a static IP and port forwarding.
Pick by what you are hosting
The real question is whether your app can live with a port number the VPN picks for it. Torrent clients can. A game server whose players saved an address and port cannot.
| What you host | What it needs | Best fit | Why | Setup guide |
|---|---|---|---|---|
| Torrenting (qBittorrent, Deluge, Transmission) | Any one port — the client accepts whatever the VPN assigns | Proton VPN, or PIA outside the US | Copy the active port into the client and update it after a reconnect. | qBittorrent port forwarding |
| Docker or NAS (Gluetun, *arr stack) | One port the container stack can update by itself | Proton VPN or PIA through Gluetun | Gluetun reads the forwarded port and can hand it to the torrent client. | Gluetun port forwarding |
| Minecraft or another game server | A known port players can save, such as TCP 25565 or UDP 19132 | PureVPN | You choose the port numbers. A random port would change the address players join. | Minecraft server VPN |
| Strict or Symmetric NAT in games | Unsolicited inbound traffic allowed | PureVPN all-ports mode | In our own test, all-ports mode changed the NAT Checker result from Symmetric to Full Cone NAT. | Change NAT type with a VPN |
| Plex, Jellyfin, or remote access | Several known ports, usually TCP | PureVPN | Each service keeps its own port behind one VPN entry point. | Plex remote access |
| An address friends or clients save | The same public IP every time, plus open ports | PureVPN dedicated IP + port forwarding | A shared VPN IP changes when you reconnect; a dedicated IP stays yours and carries the forwarded ports. | Static IP + port forwarding |
What a VPN with port forwarding gives you
A normal VPN handles traffic your device starts. Port forwarding adds one controlled doorway on the VPN server and sends that inbound traffic through the encrypted tunnel to your app. Because the public entry point lives away from the home router, this can work on CGNAT, shared Wi-Fi, or a line where you cannot edit router settings.
PATH 1
You / CGNAT
Your ISP-facing line may not accept unsolicited inbound traffic.
PATH 2
VPN public port
The supported VPN creates the reachable public doorway.
PATH 3
Your listening app
The encrypted tunnel carries that traffic to the correct service.
How to set up VPN port forwarding
Follow the path in order and you avoid changing several settings without knowing which one mattered.
- 1
Check the internet-facing connection
Compare the router WAN IPv4 with the public IPv4 shown by NAT Checker. A private, shared, or different WAN address points to CGNAT, double NAT, or another upstream gateway.
- 2
Decide which ports the app needs
Check whether the app accepts any port (most torrent clients) or needs a known port such as 25565 for Minecraft, and whether it uses TCP, UDP, or both.
- 3
Choose a VPN that supports that job
Use Proton VPN when one changing port is enough, and PureVPN when you need chosen port numbers or all ports open. Add PureVPN’s dedicated IP if the address must stay the same.
- 4
Verify from another network
Start the listening app, allow the matching port and protocol through the firewall, and test the VPN public address from mobile data or another internet connection.
What ports does a VPN use?
These are the ports a VPN app connects out to, not the inbound port you forward. If a network blocks your VPN, these are the ports to allow. Port forwarding is the other direction: the provider opens an inbound port on its server for your app.
| Protocol | Default ports | Note |
|---|---|---|
| WireGuard | UDP 51820 | Common default; many VPN apps use other UDP ports |
| OpenVPN | UDP 1194, or TCP 443 | TCP 443 looks like HTTPS and gets through strict firewalls |
| IKEv2/IPsec | UDP 500 and 4500 | 4500 carries the traffic when NAT is in the way |
| L2TP/IPsec | UDP 1701, 500 and 4500 | Older; often blocked on public Wi-Fi |
| SSTP | TCP 443 | Windows protocol that uses the HTTPS port |
| PPTP | TCP 1723 plus GRE | Obsolete and insecure; avoid it |
Port forwarding with Proton VPN for qBittorrent and P2P
Without an inbound port, qBittorrent can still start connections to reachable peers. A forwarded listening port also lets more peers start connections to your client, giving the swarm more possible paths and improving seeding or peer availability.
The qBittorrent setup that matters
- 1. Enable port forwarding and connect to a compatible P2P server.
- 2. Copy the active port into qBittorrent’s listening-port field.
- 3. Bind qBittorrent to the VPN interface so traffic cannot fall back to another route.
- 4. Test while qBittorrent is running; a checker cannot see a port with no active listener.
Verify the VPN port from public IP to app
A green “open” result is useful, but the real win is a friend joining the game, a peer connecting, or the remote service answering. Prove every hop from left to right.
- 1
Public IP
Use the VPN or server public address, not the old home address.
- 2
Forwarded port
Copy the exact assigned or selected port and match TCP or UDP.
- 3
App listener
Start the app and confirm that it is listening on the tunnel interface.
- 4
Outside-network test
Test from mobile data or another network so the path crosses the internet.
If the port still looks closed
| What you see | Likely cause | Best next move |
|---|---|---|
| The checker still says closed | No app is listening, or the OS firewall is blocking it. | Start the app, match its listening port, and allow the same protocol through the firewall. |
| It stopped after reconnecting | The VPN assigned a different active port. | Read the new port in the VPN app and update the listening application. |
| PIA says port forwarding is not available | You are connected to a US server, which does not forward ports. | Switch to a non-US region marked with the port-forwarding icon, then copy the new port. |
| A Windscribe port stopped after a week | The ephemeral port expired after its 7-day lifetime. | Request a new ephemeral port and update the app, or use a static IP for a permanent port. |
| TCP works but the game does not | The game expects UDP, both protocols, or its own session test. | Check the game documentation and verify a real join attempt in the server log. |
| Friends reach the IP, not the service | The app is bound to the wrong interface or the public rule does not match. | Bind to the VPN or tunnel interface and match the public port, local port, and protocol. |
VPN port forwarding FAQ
Checked October 30, 2026
Official and standards sources
Provider features change, so the port, platform, refund, and public-network claims on this page were checked against provider documentation and the CGNAT standard.
- RFC 6598: shared IPv4 space used by CGNAT
- Proton VPN: supported plans, platforms, P2P servers, and active ports
- Proton VPN: paid plans and 30-day refund terms
- PureVPN: open all ports or forward specific ports
- PureVPN: supported locations and add-on setup
- Private Internet Access: enabling port forwarding and supported regions
- AirVPN: reserved ports per account
- Windscribe: ephemeral and static-IP port forwarding
- Mullvad: removal of forwarded ports (2023)
- IVPN: removal of port forwarding (2023)
- PureVPN: 31-day refund policy and eligibility
- NordVPN: official inbound port-forwarding status
- PureVPN: dedicated IP locations and pricing