Port forwarding tells a NAT router where to send unsolicited inbound traffic for a specific port. It is commonly used for self-hosted services, game servers, cameras, and remote access—but opening a service to the internet increases its exposure.

Give the destination device a stable local address

Use a DHCP reservation or a carefully managed static address. If the device changes from 192.168.1.50 to 192.168.1.87, a forwarding rule aimed at the old address stops working.

Create the rule

In the router, identify the external port, internal device, internal port, and protocol. TCP and UDP are separate protocols; choose only what the service actually uses.

Make sure the service is listening

A forwarding rule cannot make a stopped application respond. Check the service locally first and verify the device firewall allows it.

Test from outside

Testing from the same LAN can be misleading because not every router supports NAT loopback/hairpinning. Use the Port Checker or a device on a different connection.

Check for carrier-grade NAT

If the router’s WAN IPv4 address is private or does not match the public IPv4 visible to the internet, the ISP may be using CGNAT. Traditional inbound IPv4 port forwarding will not work through a provider NAT unless the ISP offers a public address or alternative.

Security

Expose the smallest surface possible, keep the service patched, use strong authentication, and prefer a VPN or purpose-built secure access method when it fits the use case.

Video walkthrough for How to Configure Port Forwarding and Test It from Outside Your Network?

Explains the difference between an IP address and a TCP/UDP port. An open port still needs a secure service listening behind it.