Port Forwarding Explained: How to Open Ports on Your Router

Port forwarding is one of those networking concepts that sounds complicated but is actually straightforward once you understand what it does and why you need it. If you have ever tried to host a game server, set up a security camera for remote viewing, or run a web server from home, you have probably encountered the need for port forwarding.

This guide explains how it works, walks you through setting it up, and covers the security implications you should know about.

Need a VPS? Vultr (free credit), DigitalOcean ($200 free credit), or RackNerd (cheap annual deals).

What is Port Forwarding?

Your router acts as a gatekeeper between the internet and your home network. By default, it blocks all incoming connections — this is a good thing, because it prevents random people on the internet from accessing your devices.

Port forwarding creates a controlled exception: you tell the router "if someone connects to port X from the internet, send that traffic to device Y on my local network."

Internet → Your Public IP:8080 → Router → 192.168.1.50:8080 (your server)

Without port forwarding:

Internet → Your Public IP:8080 → Router → BLOCKED (dropped)

When Do You Need Port Forwarding?

You do NOT need port forwarding for:

• Normal web browsing
• Streaming Netflix, YouTube, etc.
• Online gaming (as a player, not a host)
• Video calls
• Most apps — they use outbound connections which work fine through NAT

How to Set Up Port Forwarding

Step 1: Find Your Device's Private IP

The device you want to forward to needs a known, static private IP. Find it first:

Windows:

ipconfig

Mac/Linux:

ifconfig
# or
ip addr show

Look for something like 192.168.1.50. Write it down.

Step 2: Set a Static IP (Important)

If your device gets its IP from DHCP (which is the default), the IP can change and break your port forwarding rule. Set a static IP either:

Option A: On the device itself — configure a static IP in network settings

Option B: DHCP reservation on the router (preferred) — tell the router to always assign the same IP to this device's MAC address. This is usually under DHCP settings in your router.

Step 3: Log Into Your Router

Open a browser and go to your router's admin page:

Default credentials are usually on a sticker on the router. Common defaults: admin/admin or admin/password.

Step 4: Find Port Forwarding Settings

The location varies by router brand, but look for:

• Port Forwarding
• Virtual Servers
• NAT / Gaming
• Applications & Gaming
• Advanced → Port Forwarding

Step 5: Create a Rule

Fill in these fields:

Step 6: Test It

After saving the rule, test from outside your network:

• Use our Port Scanner to check if the port is open from the internet
• Ask a friend to try connecting
• Use your phone on cellular data (not WiFi) to test

If the port shows as closed, see the troubleshooting section below.

Port Forwarding vs UPnP

UPnP (Universal Plug and Play) lets applications automatically create port forwarding rules without you manually configuring them. Most game consoles and apps use UPnP.

Recommendation: Disable UPnP and use manual port forwarding for anything important. UPnP is convenient but it means any malware on your network can also open ports.

Security Considerations

Port forwarding punches a hole in your router's firewall. Every open port is a potential entry point for attackers. Follow these rules:

Do

• Only forward ports you actually need — close them when done
• Use non-standard ports when possible — instead of 22 for SSH, use 2222
• Keep software updated — the service behind the port needs security patches
• Use strong passwords — especially for SSH, RDP, and admin panels
• Use a VPN instead when possible — WireGuard or OpenVPN lets you access your home network without opening any ports
• Monitor access logs — check who is connecting

Do Not

• Never forward port 23 (Telnet) — it is unencrypted
• Never expose RDP (3389) directly — use a VPN instead
• Never forward ports to a device you do not maintain — IoT devices with bad security
• Never use DMZ mode — it forwards ALL ports to one device, exposing everything

Troubleshooting

Port Shows as Closed

1. Is the service running? Check if the application is actually listening on that port
2. Firewall on the device? Windows Firewall or iptables might be blocking it. Add a rule to allow the port
3. Correct internal IP? Make sure the IP in the forwarding rule matches the device
4. ISP blocking? Some ISPs block common ports (25, 80, 443) on residential connections. Call them or use a different port
5. Double NAT? If you have two routers (ISP modem-router combo + your own router), you need to forward on both. Or put the ISP device in bridge mode
6. CGNAT? Some ISPs use Carrier-Grade NAT, meaning your "public IP" is actually shared. Port forwarding will not work. Check if your public IP starts with 100.64.x.x — if so, you are behind CGNAT

Check If Your Port is Open

Use our Port Scanner to test if a port is reachable from the internet. Enter your public IP (find it with our What's My IP tool) and the port number.

Alternatives to Port Forwarding

For most home use cases, a VPN or Cloudflare Tunnel is more secure than port forwarding and works even behind CGNAT.

Check Your Ports

Use our free Port Scanner to verify if your port forwarding is working. It checks common service ports from outside your network and tells you which ones are open. You can also use our What's My IP tool to find the public IP address you need to test against.

See Also

• How to Check if a Port Is Open
• Fix ERR_CONNECTION_REFUSED
• Public vs Private IP Addresses