Why port forwarding isn’t working

Port forwarding tells your router to send incoming traffic on a port to one device, for a game server, camera, Plex or remote desktop. If it still doesn’t work, go through these in order.

1. You’re behind CGNAT

Compare the WAN IP on your router’s status page with your public IP on FernTool. If they differ, or the WAN IP starts with 100.64–100.127, your ISP shares one public IP between many customers and no forward on your router can work. CGNAT explained. Fix: ask your ISP for a public (sometimes paid static) IP, use IPv6, or use a tunnel such as Tailscale or Cloudflare Tunnel.

2. Double NAT

If the WAN IP is a private address like 192.168.x.x or 10.x.x.x, there’s a second router upstream (often an ISP modem or fibre router). Put the first router in bridge mode, or forward the port on both.

3. The forward points at the wrong device

Device IPs change. Reserve the device’s IP on the router (DHCP reservation), then point the forward at it. Find the device’s address with this guide.

4. The device’s firewall blocks it

Windows Defender Firewall, macOS firewall and Linux ufw block unknown inbound ports. Allow the app or port.

5. Nothing is listening

A port only shows as open if a program is running on it. Start the server first, then test.

6. You’re testing from inside

Many routers don’t support “hairpin NAT”, so connecting to your own public IP from inside the house fails even when the forward works. Test from mobile data instead.

7. The ISP blocks the port

Some ISPs block inbound ports such as 25, 80 and 443 on home plans. Try a high port (e.g. 8443) to check.

IPv6

On IPv6 there is no NAT. Each device has its own public address and you open the port in the router’s IPv6 firewall instead. Check whether you have it with the IPv6 test.

Frequently asked questions

Why is my port still closed after forwarding?

The most common reasons are CGNAT, double NAT, a forward pointing at an old device IP, a device firewall, or no program listening on the port.

Can I port forward with CGNAT?

No, not from your own router. You need a public IP from your ISP, IPv6, or a tunnel service.

How do I know if I have CGNAT?

Compare the WAN IP on your router with the public IP on ferntool.com. If they differ, or the WAN IP is in 100.64.0.0/10, you are behind CGNAT.