Port forwarding guide

Before changing the router

Identify the device’s LAN IP, the application’s listening port, and whether it uses TCP or UDP. Reserve the LAN address using DHCP reservation or a suitable static configuration.

Example rule

For a service at 192.168.1.20:8080, forward external TCP 8080 to internal 192.168.1.20:8080. If the external port is different, test that external port.

Allow the intended traffic in the host firewall. Avoid opening unrelated ports or exposing database and administration services without appropriate access controls.

When the connection fails

1. Make sure the server application is running on the PC or NAS.
2. Check its listening address and TCP port. A service bound only to 127.0.0.1 accepts local connections; use the intended LAN address or interface for external access.
3. Allow the required TCP port and source addresses in the device firewall.
4. For IPv4 behind a router, map the external port to the device’s LAN IP and internal port.
5. Compare the router’s WAN IPv4 with the public IPv4 shown here. A difference can indicate upstream NAT, another router, or a VPN.

Upstream NAT and IPv6

Compare the router WAN IPv4 with the public IPv4 of the same route. Private or shared WAN space can indicate upstream NAT. An external website will usually show the NAT exit address, not that internal WAN address.

Ask the provider about inbound connectivity when upstream NAT is involved. With global IPv6, routing and firewall rules are usually the relevant checks. A successful TCP check does not validate UDP services.

Forwarding case: external 18080 → internal 8080

1. Symptom

   PPORT reports TIMEOUT for external port 18080. From another PC on the same LAN, http://192.168.0.20:8080 opens.

2. Environment

   The router rule is external TCP 18080 → 192.168.0.20:8080. Enter the external port 18080 in PPORT; check the server's listening state and LAN access with the internal port 8080. The server gets its address by DHCP. The outputs and screen notes below are illustrative, and the IPs come from documentation ranges.

3. Check

   If the LAN connection works, the server program and the server firewall accept LAN requests. Three comparisons remain: the server's current IP against the rule's internal IP, the router's WAN IP against the IP PPORT shows, and whether PPORT tested over IPv4.

   Connecting to public-IP:18080 from inside the LAN depends on whether the router supports NAT loopback, so it cannot replace an external check.

   ipconfig | findstr /C:"IPv4"
   ip -4 -br addr

4. Output and interpretation

   C:\> ipconfig | findstr /C:"IPv4"
      IPv4 Address. . . . . . . . . . . : 192.168.0.23
   $ ip -4 -br addr
   lo               UNKNOWN        127.0.0.1/8
   eth0             UP             192.168.0.23/24
   
   [Router] WAN IPv4       203.0.113.45
   [Router] Port forward   TCP 18080 -> 192.168.0.20:8080
   [PPORT]  Your IP        203.0.113.45 (IPv4)
   [PPORT]  Port 18080     TIMEOUT

   The server's address has changed to 192.168.0.23, but the forwarding rule still points to 192.168.0.20. External connections are being forwarded to an address that is not the server.

   The router's WAN IP matches the IPv4 address PPORT shows, so there is no additional NAT above the router.

5. Fix

   Add a DHCP reservation (static lease) on the router for the server's MAC address and 192.168.0.20, or change the forwarding rule's internal IP to the current address. A reservation keeps the rule from drifting the next time the address changes.

   Renewing the address during a remote session can disconnect you. Renew it at the server or apply it with a reboot.

   getmac /v /fo list
   ip -br link

6. Verify

   Confirm that the server's address is 192.168.0.20, then test 18080 again in PPORT from a browser on the same line as the server. OPEN means you are done.

   If it still times out, look at the router's WAN IP again. If it differs from the IP PPORT shows and falls in 100.64.0.0/10 or a private range, there is another NAT above your router. If you manage that upstream device, add the same forwarding rule there; if it belongs to your ISP, ask about bridge mode or a public IP. If PPORT shows an IPv6 address, it did not test your IPv4 forwarding rule; check again while connected over IPv4.

   ipconfig | findstr /C:"IPv4"

   C:\> ipconfig | findstr /C:"IPv4"
      IPv4 Address. . . . . . . . . . . : 192.168.0.20
   
   [PPORT]  Port 18080     OPEN

Tools for this guide