What Is Port Forwarding and How Do You Set It Up?

Your router keeps every device in your home hidden behind one public address. That is good for safety, but it creates a problem: when someone on the internet tries to reach your security camera, game server or remote desktop, the router has no idea which device they mean, so it drops the connection. Port forwarding is how you tell it. This guide explains the idea, walks through the setup, and covers the safety and troubleshooting steps most tutorials skip.

How NAT and ports work

An IP address identifies a machine; a port (a number from 1 to 65535) identifies a specific service on it. A web server listens on port 80 or 443, SSH on 22, and so on. A connection is therefore described by an address and a port, such as 203.0.113.5:8080.

Your router uses NAT: all devices share its one public address (see private vs public IP). Outgoing connections are tracked automatically so replies find their way back, but an unsolicited incoming connection has nowhere to go. A forwarding rule adds one:

Internet  ->  203.0.113.5:8080   (router's public IP, external port)
Router rule:  8080  ->  192.168.1.50:80
Device 192.168.1.50 receives it on port 80

What you need before you start

1. A real public IP on the router. If you are behind carrier-grade NAT, forwarding on your own router cannot work — read what CGNAT is and compare your router's WAN IP with the one on Show-IP.ir. A static IP makes the address predictable.
2. A fixed local IP for the target device. If the device's address changes, the rule points to the wrong place. Use a DHCP reservation in the router or a static address on the device (static vs dynamic IP).
3. The port number and protocol (TCP, UDP or both) the application uses — check its documentation.

Step-by-step setup

1. Log in to your router — see how to log in to your router.
2. Find the section named Port Forwarding, Virtual Server, NAT or Applications & Gaming (the name varies by brand).
3. Create a rule with: a name, the protocol, the external port, the internal IP of the device, and the internal port. External and internal ports can be the same or different.
4. Save (some routers need a restart).
5. Allow it on the device's firewall as well, otherwise the device will drop the connection itself.
6. Test from outside — use mobile data, not your home Wi-Fi, and connect to your public IP and the external port.

Common ports

Security: forward only what you must

Every forwarded port is a door opened to the whole internet, and scanners find open ports within minutes.

• Do not expose Remote Desktop (3389) directly. It is a common target for brute-force and ransomware attacks. Use a VPN into your network instead and reach the PC through it.
• Use strong, unique passwords and two-factor authentication wherever the service supports it. Change default camera and NAS passwords immediately.
• Keep the device and router firmware updated.
• Using a non-standard external port reduces noise from bots, but it is not real security.
• Consider alternatives that need no open port: a VPN you host (WireGuard), a mesh VPN, or a tunnel service.
• Remove rules you no longer use.

Troubleshooting: "port closed" even though the rule exists

• CGNAT. The most common cause. If the router's WAN IP is not your public IP, no rule on your router can work.
• Double NAT. A modem and a router, each doing NAT. Forward on both, or put the first device in bridge mode.
• Wrong internal IP. The device got a new address. Use a reservation.
• The service is not listening. Check on the device: netstat -ano (Windows) or ss -tlnp (Linux) should show the port in LISTEN state.
• Firewall. The Windows/Linux firewall or antivirus is blocking it.
• Testing from inside the network. Many routers do not support "hairpin" access to your own public IP from the LAN. Test from mobile data.
• ISP blocking. Some providers block inbound ports such as 80 or 25 on home lines. Try another external port.

Port forwarding, port triggering and UPnP

Port forwarding is a permanent rule you set manually. Port triggering opens a port only temporarily after the device makes an outgoing connection on a trigger port. UPnP lets applications open ports on the router automatically — convenient for games, but any program on your network can use it, so many security guides recommend turning it off if you do not need it.

Key takeaways

• Port forwarding maps an external port on your router's public IP to an internal IP and port on one device.
• It needs a real public IP (not CGNAT) and a fixed local address for the device.
• Test from outside your network, and forward as few ports as possible.
• Prefer a VPN over exposing services like Remote Desktop directly to the internet.