What is port forwarding, and do I need it?
The router setting people are told to change for cameras, servers and consoles. What it actually does, the fixed address you need first, why it may not work on your connection at all, and the safer alternatives.
- Difficulty
- advanced
- Time
- 35 min
- Read
- 6 min
- Safety
- caution
Short answer
Your router hides every device behind one public address and only lets in traffic that was asked for. Port forwarding creates a permanent exception: traffic arriving on a chosen port number is sent to one specific device. You need a fixed internal address for that device first, and on many UK broadband connections it will not work at all because you do not have your own public address — which is worth checking before you spend an evening on it.
A home router does two protective things almost incidentally. It shares one public address among every device in the house, and because incoming traffic has no way of knowing which device to reach, unsolicited traffic is simply dropped. That is why nothing on your home network is directly reachable from the internet, and it is a far more important defence than most people realise. Port forwarding is the deliberate hole in it. It is genuinely necessary for a small set of things — hosting a game server, running a home server, some older camera systems — and it is recommended far more widely than it is needed, often by product documentation that predates better alternatives.
Safety
Step by step
- Check whether you need it at all.Almost everything that used to require port forwarding now uses an outbound connection to the manufacturer's service instead — cameras, doorbells, smart home hubs, remote desktop services and modern game consoles. If the product offers that, use it. Forwarding is for the cases where nothing else exists.
- Find out whether you have your own public address.Many UK mobile broadband services and some fixed providers put customers behind carrier-grade network address translation, where hundreds of homes share one public address. Port forwarding cannot work on such a connection. Compare the address your router shows for its internet connection with the address a what-is-my-IP site reports — if they differ, you are behind CGNAT and forwarding will not work.
- Give the target device a fixed internal address first.Forwarding sends traffic to a specific internal address. If that address changes — which it will, because addresses are leased and renewed — the rule points at nothing, or worse, at a different device. In the router's settings, find the DHCP reservation list and tie the device's hardware address to a fixed internal address.
- Find the device's hardware address correctly.Every network interface has a MAC address, and a device with both wifi and ethernet has two different ones. Reserve the one for the connection the device actually uses. Many phones also randomise their MAC address per network, which breaks reservations unless that is turned off for your home wifi.
- Create the rule with the narrowest scope you can.One port, or the smallest range, to one internal address, for one protocol. Avoid rules that forward wide ranges. If the router supports restricting the rule to specific source addresses, use it — that alone removes most of the exposure.
- Secure the thing you have just exposed, before you expose it.A unique strong password, current firmware, and any default account disabled or renamed. Automated scanners find newly opened ports within minutes and try default credentials immediately. This is not caution, it is the observed behaviour of the internet.
- Deal with your address changing.Most home connections get a public address that can change. A dynamic DNS service gives you a stable name that follows it, and many routers have one built in. Without it, remote access works until the address changes and then silently does not.
- Prefer a VPN into your home over forwarding several things.If you want access to more than one device, running a VPN server — many routers include one — gives you a single encrypted way in and leaves everything else invisible. It is more work to set up once and considerably safer than a collection of forwarded ports.
Common mistakes
- Forwarding a remote-desktop or camera port to a device with a weak password — These are the two most heavily scanned categories on the internet. A camera or a remote desktop with a default or reused password is found and accessed, reliably, within hours.
- Putting a device in the DMZ to make it work — That forwards everything to that device rather than one port, removing the router's protection entirely for it. It is offered as a troubleshooting step and should never be a permanent arrangement.
- Forwarding by internal address without a reservation — Addresses are leased and change. The rule then points at whatever device happens to hold that address, which is both broken and, occasionally, a real exposure.
If it doesn't work
The rule is set and nothing reaches the device
Cause: CGNAT, a second router, or a firewall on the device — Fix: Check the public address question first. Then check whether there are two routers in the chain — the catalogue's guide on double NAT covers that, and forwarding must be configured on the outermost one.
Works for a while then stops
Cause: The internal address changed, or the public address changed — Fix: Set a DHCP reservation for the device, and use a dynamic DNS name rather than the raw public address.
Works from outside but not from inside the house
Cause: The router will not loop traffic back to itself — Fix: Known as NAT loopback or hairpinning, and not all routers support it. Use the device's internal address when you are at home and the external name when you are away.
The router opened ports you did not ask for
Cause: UPnP, which lets applications request forwarding automatically — Fix: Convenient for games and consoles, and a genuine risk because any program on the network can request it. Review the list of automatically opened ports, and consider turning UPnP off if you are willing to configure the exceptions by hand.
Your provider blocks the port
Cause: Some ports are blocked by providers on residential connections — Fix: Common for mail and web server ports. Using a non-standard external port that forwards to the standard internal one is the usual workaround where the application allows it.
You start seeing login attempts in the device's log
Cause: Automated scanning, which is normal and constant — Fix: Expected, and a reason to make sure the password is strong and the software current. If the device does not need to be reachable, remove the rule.
Questions people ask
What is a port, exactly?
A number that says which service on a device the traffic is for. One address can run many services, so the port distinguishes them — web traffic conventionally on 80 and 443, and so on. Forwarding a port means "traffic arriving here for this number goes to that device".
Is UPnP safe to leave on?
It is a convenience trade-off. It lets games and consoles open what they need without you configuring anything, and it also lets any program on your network — including malware — open a route in without asking you. For most households, leaving it on and having a network with nothing badly out of date on it is a reasonable position; turning it off is the more cautious one.
Does a VPN make port forwarding unnecessary?
For getting to your own devices from outside, largely yes, and it is the better answer. It does not help for things that need to accept connections from other people, such as hosting a game server for friends.
How do I know if I am behind CGNAT?
Compare the internet address shown in the router's status page with the address reported by a what-is-my-IP website. If they match, you have your own public address. If the router shows a private-looking address while the website shows a different one, you are sharing, and forwarding cannot work. Some providers will move you off it on request.