How to Port Forward on Your Router (and Test It Works)

Published July 14, 2026 · 9 min read

Port forwarding is one of those tasks that sounds intimidating but comes down to a single idea: telling your router where to send incoming connections. Whether you're hosting a game server, reaching a home NAS while you're out, running a security camera you can check remotely, or self-hosting a small website, port forwarding is what makes a device inside your network reachable from the internet.

This guide walks through the whole process on any router, then — the part most tutorials skip — shows you how to actually verify the port is open so you're not left guessing why it "isn't working."

What Port Forwarding Actually Does

Your home has one public IP address, shared by every device behind your router. When a connection arrives from the internet, your router needs to know which internal device it's for. By default it doesn't — unsolicited inbound connections are simply dropped, which is a good security default.

A port forwarding rule creates an exception: "any connection arriving on port X, send it to this device at this internal port." It's like adding a specific mail-forwarding instruction to a building's front desk so a particular letter reaches the right apartment.

Three pieces of jargon you'll meet, in plain terms:

• External port — the port people connect to on your public IP.
• Internal port — the port your device is actually listening on. Often the same number as the external port, but it doesn't have to be.
• Protocol — TCP, UDP, or both. Use whatever the service documentation specifies; if unsure, most services are TCP.

Before You Start: Reserve a Static IP

This is the step that trips up almost everyone, so do it first. Your router hands out internal IP addresses via DHCP, and those addresses can change when a device reconnects. If you forward a port to 192.168.1.42 today and your console becomes 192.168.1.57 tomorrow, the rule silently points at nothing.

The fix is a DHCP reservation (sometimes called "static lease" or "address reservation"): you bind a device's MAC address to a fixed internal IP so it always gets the same one. Set this up in your router's DHCP settings before creating any forwarding rule, and your forwards will keep working across reboots.

Step-by-Step: Setting Up the Forward

Step 1 — Find the device's local IP

Identify the private IP of the device you want to reach — something like 192.168.1.42. You'll find it in the device's own network settings, or faster, in a LAN scan of your network.

Step 2 — Reserve that IP

In your router's DHCP settings, add a reservation binding that device's MAC address to the IP. This locks it in place.

Step 3 — Open the router admin panel

Browse to your router's gateway address — commonly 192.168.1.1 or 192.168.0.1 — and log in. Not sure of the address? See how to find your router's IP on iPhone.

Step 4 — Find the Port Forwarding section

It lives under different menus depending on the brand — look for "Port Forwarding," "Virtual Server," "NAT," "Applications & Gaming," or "Advanced." Here's where the common brands hide it:

Step 5 — Create the rule

Add a new rule with these fields:

• Name/Description — something you'll recognise later, e.g. "Home NAS".
• External port — the port to accept from the internet.
• Internal port — the port the device listens on (often the same).
• Internal IP — the reserved IP from Step 2.
• Protocol — TCP, UDP, or both, per the service's docs.

Step 6 — Save and reboot if asked

Apply the rule. Some routers need a reboot before a new forward takes effect — if yours prompts you, do it.

The Step Everyone Skips: Verify It Works

You've saved the rule — but is the port actually open? Guessing is where hours get lost. Test it in two layers, from the inside out.

1. Check the port is open on your local network

First confirm the service is genuinely running and reachable inside your network. Point PingKit's Port Scanner at the device's local IP and scan the port you forwarded. If it shows open, the device and its service are working — the problem, if any, is upstream at the router. If it shows closed or filtered, the service isn't running or a firewall on the device is blocking it, and no amount of router configuration will help until you fix that.

A good scanner reports three states, and knowing the difference saves you: open (something is listening), closed (nothing is listening but the host replied), and filtered (a firewall silently dropped the probe). See how to check if a port is open for a full breakdown.

2. Check reachability from outside

Once the port is confirmed open locally, verify the forward itself. Find your public IP (PingKit's Network Info shows it), then test whether the port is reachable on that public address from outside your network. If it's open locally but unreachable externally, the issue is the forwarding rule, a double router, or your ISP — see the troubleshooting list below.

Why Port Forwarding "Isn't Working": The Usual Suspects

1. The device IP changed. You skipped the DHCP reservation and the rule now points at the wrong device. This is the #1 cause.
2. The service isn't actually running. The game server crashed, the NAS service is off, the camera is asleep. A local port scan shows the port closed.
3. A device firewall is blocking it. The rule and service are fine, but the device's own firewall drops the port. Scan shows filtered.
4. Wrong protocol. You forwarded TCP but the service uses UDP (or vice versa).
5. Double NAT. There are two routers in series (e.g. your ISP's modem-router plus your own). You need the forward on both, or to put one in bridge mode.
6. Carrier-Grade NAT (CGNAT). Your ISP doesn't give you a real public IP — many mobile and some fibre providers use CGNAT, which makes inbound port forwarding impossible without a static IP add-on or a relay/tunnel service. If your public IP (from Network Info) doesn't match what an external "what's my IP" site reports, suspect CGNAT.

Do It Safely

A few rules of thumb that keep port forwarding from becoming a liability:

• Never forward remote-management ports like Telnet (23) or unsecured remote desktop to an untrusted device — these are constantly probed from the internet.
• Prefer a VPN into your home network over forwarding lots of individual ports. Many modern routers include a built-in VPN server; it exposes one well-secured door instead of many.
• Use strong, unique passwords on anything you expose, and enable any available two-factor authentication.
• Audit periodically. Old forwards to devices you've forgotten are exactly the kind of exposure PingKit's Security Scan is built to flag on your own network.

Set the reservation, add the rule, and — most importantly — verify each layer with a scan. Do those three things and port forwarding stops being guesswork.