How to Port Forward on Your Router: Step-by-Step Guide and Why It Sometimes Fails

Port forwarding tells your router: “when a connection from the internet arrives on this port, send it to that device at home.” You need it to host a game server, reach a home camera or NAS from outside, run a web or Plex server, or fix a “strict NAT” warning on a console. The setup itself is a single form in the router. Most failures come from the steps around it — a device whose address keeps changing, a provider that does not give you a public IP, or a firewall on the device — and this guide covers those too.

What Port Forwarding Does

All devices in your home share one public IP address, the one your provider gives the router. Inside, each device has its own private address such as 192.168.1.23, and the router translates between the two (NAT). Outgoing connections work automatically: the router remembers who asked for what. Incoming connections are different: when someone on the internet connects to your public address, the router does not know which device should receive it, so by default it blocks the attempt. NETGEAR’s documentation describes exactly this: the router’s firewall blocks incoming connections from the internet unless you create an exception.

A port forwarding rule is that exception. It says: traffic to public port 25565 goes to the PC at 192.168.1.23, port 25565 — and nothing else is opened.

Check This Before You Start

Do you have a public IP address? Port forwarding only works if the router itself has a public address on its internet (WAN) side. ASUS lists this as the first requirement in its own port forwarding guide. Many providers, especially mobile, fixed-wireless and some fibre providers, use carrier-grade NAT (CGNAT): they share one public address among many customers, so no rule on your router can make you reachable. To check, compare the WAN address on your router’s status page with the address shown on What Is My IP. If they differ, or the WAN address starts with 100.64–100.127 or is a private address like 10.x.x.x, you are behind CGNAT or a second router — see the troubleshooting section below.

Which ports does the app need? Games, cameras and servers document their ports, often with both a TCP and a UDP list. Use the developer’s list rather than guessing, and open only those.

Which device should receive the traffic? Note its local IP address. On a computer, What Is My Local IP explains where to find it; consoles show it in their network settings.

How to Set Up Port Forwarding

1. Give the device a fixed local address. In the router, find DHCP Reservation (also called Address Reservation or Static Lease), pick the device and reserve its current address. Without this the device may get a different address after a restart, and the rule will point at nothing. NETGEAR recommends reserving the address first for this reason.
2. Sign in to the router at its address — usually 192.168.0.1 or 192.168.1.1; our router login guides list the default for your model.
3. Open the port forwarding page. The name varies: Port Forwarding, Virtual Server, NAT Forwarding or Applications & Gaming.
4. Add a rule: a name, the external port (or range), the internal port (usually the same), the protocol (TCP, UDP or both) and the device’s local IP address. Many routers offer ready-made entries for common services.
5. Save, then test from outside your network, as described below.

Where Port Forwarding Is on Popular Routers

ASUS also offers a “famous server list” with presets such as FTP, and NETGEAR lets you create a custom service when the application is not in the list. Some routers still have Port Triggering, a different feature that opens a port only after a device makes a matching outgoing connection; for servers and consoles, use port forwarding.

How to Test an Open Port

A port is open only when three things are true: the rule exists, the device is on, and an application on the device is actually listening on that port. Start the game server or service first, then check from outside your network: our port checker fills in your public IP and tests whether a port answers. Testing from a computer inside your own network can mislead, because many routers do not handle connections from inside to their own public address (so-called NAT loopback).

If the checker says the port is closed, go through the list in the next section in order.

Why Port Forwarding Doesn't Work

The service is not running or listening. A closed result often simply means nothing is answering. Start the server and check that it listens on the port you forwarded.

The device firewall blocks it. Windows Defender Firewall and other security software block incoming connections by default. Allow the application or the port on the device itself.

The device’s address changed. If you skipped the reservation, the device may now have a different local IP. Reserve it and update the rule.

Double NAT. If your own router sits behind a provider’s modem-router, the provider’s box blocks the traffic before your rule sees it. Either forward the port on both devices (on the provider box, to your router’s WAN address), or put the provider’s box in bridge mode so your router gets the public address directly.

CGNAT. If the provider shares one public IP among customers, no setting at home will help. Ask the provider for a public (sometimes called “static” or “dedicated”) IPv4 address — some include it, some charge for it — or use a service that works without incoming connections, such as a VPN or tunnel service designed for remote access.

The provider blocks the port. Some providers block well-known ports such as 25 (mail) or 80 on residential lines. Use a different external port and map it to the same internal port.

Wrong protocol. A game that needs UDP will not work with a TCP-only rule. When the documentation lists both, add both.

Keep Port Forwarding Safe

Every forwarded port makes one service on one device reachable from the whole internet, and automated scanners constantly probe public addresses for open ports. Open only the ports you need, to the device that needs them, and remove rules you no longer use. Keep the exposed software updated and protected with strong passwords — this matters most for cameras, NAS boxes and remote-desktop ports, which attackers actively look for. Never forward the router’s own admin page, and keep remote management off unless you need it; see how to change your router admin password for the rest of the router’s basic security. UPnP, which lets apps open ports on their own, is convenient for games but lets any program on the network do it; if you set up the ports you need by hand, you can turn UPnP off.