Port Forwarding: How to Open a Port Safely

What a Forwarding Rule Actually Does

Your home devices share one public IP address. When a device starts a connection, the router remembers it and routes the replies back. When a connection arrives uninvited, the router doesn’t know which device should get it, so it drops it.

A forwarding rule fills that gap with a fixed instruction: traffic arriving on this public port and protocol goes to this local address and port, as in TCP 25565 → 192.168.1.50:25565. Menus call it Port Forwarding, Virtual Servers, NAT Forwarding or Port Mapping.

Two nearby settings differ. Port triggering opens a port briefly after a device sends traffic out. DMZ sends all unsolicited traffic to one device; avoid it, since it’s the widest opening a router offers.

Do You Need One? Try These First

Many apps need no forwarding, because they rely on outgoing connections. A console reporting a moderate or strict NAT type can often still play online, with some limits.

Check these first:

• CGNAT. If your ISP uses it, no rule on your router will work (see below).
• The app’s own remote access. Many camera, storage and media apps offer a cloud or relay connection with no open port.
• A VPN. For reaching your own files, a VPN on your router or a remote-access service avoids exposing each app.
• UPnP, if you accept the trade-off covered at the end of this page.

Give the Device an Address That Won’t Change

A rule points at a local IP address, but DHCP can hand a device a different one after a restart. The rule then points at nothing or the wrong device. Fix the address first:

• DHCP reservation (preferred). On the router page called Address Reservation, DHCP Reservation or Static Lease, pick the device and assign it an address it will always get.
• A static IP on the device. Set it manually, outside the router’s DHCP range so nothing else receives it.

To see a computer’s current address, run ipconfig on Windows or ip addr on Linux. If the device uses a private or randomized Wi-Fi address, the reservation can stop matching when that address changes; a wired connection avoids this.

Filling In the Rule: A Worked Worksheet

Start by opening the router admin panel, or fix an admin page that will not open first. Field names vary by model. Here’s a worksheet for a Minecraft Java Edition server on a computer reserved at 192.168.1.50 (your network’s range may differ):

Then create the rule:

1. 01
   Step 1: Sign in to the router and open the port forwarding section.
2. 02
   Step 2: Choose Add or Create, and give the rule a name you will recognize later.
3. 03
   Step 3: Enter the reserved local IP address of the device that runs the app.
4. 04
   Step 4: Enter the external and internal port numbers from the app documentation.
5. 05
   Step 5: Choose the protocol the app requires, then save and enable the rule.
6. 06
   Step 6: Confirm the app is running and allowed through the firewall on that device.

External and internal ports usually match. Plex is a documented exception: you can pick another external port, but the internal port must stay 32400.

Example Rules for Consoles, Plex and Minecraft

These come from vendor support pages as of our last update. Ports can change and individual games may need more, so check the game’s or app’s own support page before copying.

Honest caveats:

• One external port can reach only one device, so two consoles can’t both have 3074 forwarded.
• Xbox calls its list ports that must be open, and singles out UDP 9002 for manual forwarding when remote play fails on Strict NAT. PlayStation says its list may help and refers you to your ISP.
• PlayStation’s UDP range is huge. Forwarding all of it is a big opening, so weigh it against UPnP.

TCP, UDP or Both?

The protocol must match what the app uses, or the rule does nothing.

• TCP sets up a connection and confirms delivery. Plex and Minecraft Java use it.
• UDP skips that handshake, which suits real-time game and voice traffic. Minecraft Bedrock uses it.
• Both is for ports a vendor lists under each, such as Xbox’s 3074.

Pick exactly what’s documented; Both “just in case” opens more than needed. Most online port checkers test only TCP, so confirm a UDP rule by using the app.

Testing the Open Port From Outside Your Home

Test from outside. A check from inside can fail even when the rule works, because not every router supports NAT loopback (hairpinning), which lets you reach your own public address from home.

1. 01
   Step 1: Find your public IP on a what-is-my-IP site.
2. 02
   Step 2: Start the app on the device.
3. 03
   Step 3: Put a phone on mobile data with Wi-Fi off, or ask a friend to try from their connection.
4. 04
   Step 4: For TCP, from a computer outside your network, run Test-NetConnection -ComputerName <public-IP> -Port 25565 in PowerShell or nc -vz <public-IP> 25565 on macOS or Linux.
5. 05
   Step 5: For UDP, open the game or app from outside and try to connect.

If it fails, check that the app is running, the device firewall allows it, the address hasn’t changed and the protocol is right. Some ISPs also block inbound ports, so ask yours.

CGNAT and Double NAT: When Forwarding Can’t Work

Forwarding only works if your router holds the public address.

Double NAT means two boxes at home route traffic, usually an ISP modem-router with your own router behind it. Forward on both, or put the ISP unit in bridge mode. For rented gear, see forwarding on an Xfinity gateway for a common case.

Carrier-grade NAT (CGNAT) means the ISP shares one public IPv4 address among many customers. You don’t control that outer layer, so no rule on your router can get through it.

To check, compare the WAN or Internet IP on your router’s status page with the public IP a website shows, the same test Plex suggests:

Under CGNAT, ask the ISP for a public IPv4 address (sometimes a paid static IP), use IPv6 where both ends support it (allowing traffic in the IPv6 firewall rather than forwarding), or use a relay or VPN service.

Keeping an Open Port From Becoming an Open Door

A forwarded port bypasses the router’s default protection, so the app behind it becomes your front line.

• Forward only the listed ports to one reserved address. No spare ranges, and never DMZ.
• Never expose management pages: the router’s admin page, Remote Desktop (TCP 3389), Windows file sharing (SMB, TCP 445), or camera and storage web interfaces.
• Keep the exposed software updated and use its access controls. Microsoft’s Bedrock reference strongly recommends online-mode for internet-facing servers and offers an allow list.
• Restrict the source IP if your router allows it, and delete rules you no longer use.
• Prefer a VPN for reaching your own devices.

UPnP needs a deliberate choice. It opens ports whenever a console or app asks, which saves setup, but any program on your network can ask without a password, malware included. Once manual rules cover your devices, you can usually turn it off; if you keep it, review its port-mapping table now and then. Our hardening guide covers the security side of open ports.