What is port forwarding, and how do you set it up?

Every home network sits behind NAT: all your devices share one public IP address, and the router keeps a table of which inside device started which outgoing connection so it can route the replies back. That works for everything you start yourself. It fails for connections that start on the outside, because nothing in the table matches: a friend connecting to your game server, your phone connecting to a home camera, another peer connecting to your torrent client. The router discards them.

A port forward is a permanent entry in that table. It says: anything arriving on port 25565 of my public address belongs to 192.168.1.50. The port number is how the router tells services apart; the device's private address is where it sends them. Ports range from 1 to 65535, and each one is separate for TCP and UDP. Our NAT guide covers the translation mechanism itself, and the common ports list shows which numbers belong to which services.

• Hosting a game server for friends: a Minecraft Java server listens on TCP 25565, many dedicated servers use a UDP port in the game's documentation.
• Console multiplayer with an open NAT. Consoles usually manage this through UPnP, but when NAT shows as strict or moderate, a manual forward fixes it. Xbox uses TCP and UDP 3074 plus UDP 88, 500, 3544 and 4500; PlayStation lists TCP 80, 443, 3478, 3479 and 3480 and UDP 3478, 3479 and 49152 to 65535.
• Media servers such as Plex (TCP 32400) or Jellyfin when you want remote access without the vendor's relay.
• Security cameras and NAS boxes you check from outside, though a VPN is the safer way to do this (see the security section).
• Running your own VPN server at home: WireGuard needs its UDP port forwarded, usually 51820.
• Peer-to-peer applications, where an open port lets other peers connect to you and improves speeds.

You do not need it for ordinary browsing, streaming, video calls or online games that connect to the publisher's servers, which is most of them. If something works without it, leave it closed.

1. Give the device a fixed local address. A forward points at an IP, and a device that gets a new address from DHCP next week will silently stop receiving traffic. Set a DHCP reservation for the device in the router (the static vs dynamic IP guide explains how), and note the address with the local IP finder if you are unsure of it.
2. Open the router's admin page. Type its address into a browser, usually 192.168.1.1, 192.168.0.1 or 10.0.0.1; the router IP guide shows how to find it. Mesh systems use their app instead.
3. Find the port forwarding page. Vendors name it differently: Port Forwarding (Netgear, under Advanced > Advanced Setup), Virtual Servers or NAT Forwarding (TP-Link), WAN > Virtual Server / Port Forwarding (ASUS), Applications & Gaming (older Linksys), Settings > Advanced networking > Reservations & port forwarding in the eero app.
4. Add a rule. Enter a name, the external port (the one the internet connects to), the internal port (usually the same), the protocol (TCP, UDP or both) and the device's internal IP. Some routers ask for a port range; enter the same number twice for a single port.
5. Save and apply. Some routers need a reboot. Make sure the device's own firewall allows the port too: Windows Defender Firewall or macOS's firewall will block an inbound port the router has forwarded if the application is not allowed through.

If the only reason you need a forward is a console or a game, try enabling UPnP on the router first. Devices then request their own forwards automatically and release them when done. The trade-off is that any program on any device can open a port without asking you, which is why security-minded users keep UPnP off and forward by hand.

Testing from inside your own network proves nothing, because the router handles inside connections differently. The port checker connects to your public IP from our server, the way the internet would, and reports one of three results:

Run the test with the service running. A forward to a port nothing is listening on shows as closed, not open, even when the rule is perfect. For UDP, the checker can only confirm that a port is not actively refused, since UDP services do not acknowledge connections; test those with the application itself.

Two situations make port forwarding impossible from your router alone, and together they account for most "I did everything right and it still shows filtered" cases.

• Carrier-grade NAT. Many ISPs, and almost all mobile and 5G home internet, put your router behind a second layer of NAT in their own network. Your router's "public" address is then something like 100.64.12.7, from the range reserved for this purpose, and the real public address is shared with other customers. A forward on your router never sees the traffic because the ISP's NAT dropped it first. The NAT type test tells you whether you are behind CGNAT; our CGNAT guide covers the ways around it, which come down to asking the ISP for a public IP, using IPv6, or a tunnel service.
• Double NAT at home. If an ISP modem-router sits in front of your own router, there are two NATs in the house and the forward must be made on both, or the ISP box put into bridge mode so only your router does NAT. The symptom is that the WAN address shown on your router starts with 192.168. or 10. instead of matching the public address on the homepage.

A third, simpler cause: your public IP changed. If you gave someone your address last month, confirm it is still the same, or set up dynamic DNS so a hostname tracks it.

Every open port is a door the whole internet can knock on, and automated scanners find new ones within hours. The rules that keep this manageable:

1. Never forward remote desktop, SMB file sharing or a database. RDP (3389), SMB (445), SSH with password login (22) and database ports are the ones attackers target by name. Reach them through a VPN instead.
2. Prefer one VPN port to many service ports. Forward a single UDP port to a WireGuard or router-hosted VPN server, connect to it from outside, and then use every home service as if you were on the LAN. One hardened door replaces a dozen.
3. Forward to the device, not a DMZ. A "DMZ host" setting forwards every port to one device. It is a shortcut that exposes that device completely.
4. Keep the exposed service updated and give it a strong, unique password. The port is not the vulnerability; an old Plex build or a camera with the default login is.
5. Disable UPnP unless you rely on it, and review the router's forwarding list every few months for rules you no longer need.
6. Scan yourself. Run the port checker against the ports you forwarded and a few you did not. The second group should all come back filtered. Our guide to what someone can do with your IP explains why an open port is the one thing that changes that answer.