Introduction
You start a Minecraft or Hytale server at home, send your friends the address, and nobody can join. Or a game, a camera app or Plex tells you to "open ports". Both point to the same router setting: port forwarding.
What is port forwarding? It is a rule on your router that sends incoming connections on one port to one device in your home network. Without that rule, the router has no idea which device a connection from the internet is meant for, so it passes it to none of them. Routers label the setting Port Forwarding, Virtual Server or NAT Forwarding, and you may also see it called port mapping.
Below: how port forwarding works, when you need it and when you do not, whether port forwarding is safe, how it differs from UPnP and DMZ, how to set it up on any router, how to check if a port is open, and what to do when port forwarding is not working.
What is port forwarding?
Your router gives every device at home a private address, such as 192.168.1.20, and shares one public IP address between all of them on the internet. This is NAT, network address translation. When your laptop opens a website, the router remembers that connection and lets the reply back in. A connection that starts on the internet matches nothing the router remembers, so it does not reach any device.
Port forwarding is a fixed exception, which the NAT standard calls a static mapping. You tell the router: anything that arrives on my public address at port 25565 goes to 192.168.1.20, port 25565. From then on, a friend who enters your public address and that port reaches the server on that one device, and every other device in your home stays out of reach.
How port forwarding works
A port is a number from 0 to 65535 that tells a device which program a connection is for. One computer can run a web server on port 443, a game server on 25565 and a file share on 445 at the same time. The router's rule matches the port number and the protocol, and the outside and inside numbers can differ: public port 25570 can go to port 25565 inside.
TCP vs UDP: which protocol to forward
Every port number exists twice, once for TCP and once for UDP. TCP sets up a connection and resends lost data, which suits web pages and files, while UDP sends packets with no setup and no resending, which suits games and voice, where a late packet is useless anyway. A rule for TCP does not open the same number on UDP. The Hytale server manual, for example, says to forward UDP port 5520 and that TCP forwarding is not required. The router lets you pick TCP, UDP or both, and the game's own documentation says which one it needs.
When do you need port forwarding?
You need port forwarding when something in your home has to accept connections that start outside: your device is the server, and other people or devices connect to it.
Hosting a game server: Minecraft, Hytale and others
A Minecraft server for friends is the classic case. Minecraft's own server download page says you may need to open port 25565, the default Minecraft port for Java Edition, so players can connect from outside your network. The Bedrock Dedicated Server listens on port 19132 by default, set by its server-port option.
A Hytale server works the same way. Its official server manual gives a default port of 5520, says Hytale uses the QUIC protocol over UDP, and tells you to forward UDP 5520 to the server machine when it sits behind a router. Opening your own world to friends from inside the game is different: Hytale says it sets up the connection itself, tries automatic port forwarding, and that you do not need to change anything on your router unless the game tells you to.
Any other dedicated server you run at home follows the same pattern. The game's own documentation names the port and the protocol, and those are the only ones to forward.
Remote access, cameras, NAS and Plex
The other common reason is reaching your home from outside: a security camera or a video recorder, a NAS with your files, a home automation hub, a remote desktop or a media server. Plex is a typical example. It first tries to open a port by itself through the router's UPnP or NAT-PMP feature. When that fails, Plex's instructions are to forward an external port to internal port 32400 on the device running Plex Media Server and enter that public port in its settings.
These are also the cases where a mistake costs the most, because the device behind the port holds your files or your camera feed.
When you do not need port forwarding
Joining someone else's game, playing online on a console, streaming, video calls and browsing all start from your side, and the router lets the replies back in by itself.
Consoles show this in their own help pages. Xbox lists the ports its network uses, but its fix for a NAT problem starts with UPnP, and port forwarding comes later as an advanced step. It also points out that port forwarding for an Xbox is done on the router, not on the console. PlayStation's list of ports is the ports the console uses to reach PlayStation servers, so the advice there is to make sure the router does not block them, not to forward them. If what you want is a better NAT type, read NAT type explained first.
Does port forwarding improve ping or speed?
No. Port forwarding decides whether a connection gets in at all. It does not change the route your traffic takes or the speed of your line, so ping and download speed stay the same. What it can change is who can connect to you. Xbox, for example, says that with a Strict NAT you can only play with people who have an Open NAT and cannot be chosen as the host of a match.
Is port forwarding safe?
A single rule for a game server is not dangerous by itself, but it does make one program on one device reachable by anyone on the internet, not only by your friends. How safe it is depends on that program and that device.
What can go wrong
- The program behind the port has a flaw. Whatever listens on a forwarded port talks to strangers, and if that software has a known vulnerability and is out of date, an attacker can use it to get into the device.
- Scanners find the port. Search engines such as Shodan collect information about every device directly connected to the internet and record what answers on which port. Nobody needs to know you personally for your address and port to turn up.
- The device was never meant to face the internet. Remote desktop, a router's own admin page, a NAS login or a cheap camera often assume nobody outside the home can reach them. About remote desktop on a home PC, Microsoft says opening the PC up to the internet "isn't recommended" and that it is preferable to use a VPN.
- One device leads to the rest. A compromised device inside your network can reach every other device there, because the router treats it as a trusted insider.
- Old rules stay. A rule stays active on the router after you stop playing. With the server closed, nothing answers on that port and the risk is small, but the rule now points at whatever starts listening on that port on that device later, and at whichever device gets that local address next.
Is port forwarding safe for gaming?
Forwarding the one port a game server names to the PC that runs it is about as safe as port forwarding gets. A game server is built to accept connections from strangers, its developers patch it, and the rule covers one port on one device. The risk grows with mods and plugins from unknown sources, a server left running unattended for months, or a server on the same PC where you keep your files and passwords.
How to port forward more safely
- Forward only the port and the protocol the documentation names, to one device, never a whole range "just in case".
- Use a DHCP reservation, so the device keeps the same local address and the rule cannot land on another device.
- Keep the server software and the device updated, and use a strong password wherever the service has a login.
- Never forward remote desktop, the router's admin page, a NAS login or a camera's web page. Reach those through a VPN or one of the options at the end of this article.
- Delete rules you no longer use, and check from outside now and then what is open. The US cybersecurity agency CISA gives the same advice for home routers in general: turn off services you do not need, including the router's own remote management.
Port forwarding vs UPnP, DMZ and port triggering
Routers offer four ways to let a connection from the internet in. They differ in who opens the port and how much it opens.
| Method | Who opens the port | What it opens | When it closes |
|---|---|---|---|
| Port forwarding | You, once, in the router | The ports you choose, to one device | Never by itself: the rule stays until you delete it |
| UPnP | Any program on your network, without asking you | Whatever the program asks for | When the program removes it |
| Port triggering | The router, after a device sends traffic out on a trigger port | Preset ports, to the device that triggered them, one device at a time | When it is no longer needed |
| DMZ host | You, in the router | Every port of one device | When you turn it off |
The short version of port forwarding vs UPnP is control against convenience. A manual rule opens exactly what you chose. UPnP lets software on your network ask the router to open ports without involving you, and CISA advises turning it off when it is not needed, because malware inside a network can use it to get past the router's firewall. Whether UPnP is safe is a question of its own. A DMZ host has all TCP and UDP ports open to the internet except those forwarded elsewhere, and TP-Link tells you to disable it when it is not in use. Xbox adds one more tip: do not combine port forwarding, UPnP and DMZ settings.
How to port forward: the steps on any router
Menus differ between router brands and change with updates, but the steps are the same on every router:
- Find the port and the protocol. Take them from the game's or the app's own documentation or server settings, not from a random list: Minecraft Java uses 25565 by default, Hytale UDP 5520, Plex 32400.
- Give the device a fixed local address. Look up its current local IP address (the device's network settings show it) and create a DHCP reservation for it in the router, so the address does not change after a restart. A static IP set on the device works too.
- Create the rule. In the router's port forwarding section, which may be called Virtual Server or NAT Forwarding, enter the external port, the internal port, the protocol (TCP, UDP or both) and the device's local address. The router's admin page usually sits at the default gateway address, which is printed on the router or shown in your device's network settings.
- Let the program through the device's firewall. The firewall on the computer can block the connection even when the router passes it.
- Test from outside your network. Reaching your own public address from inside depends on a router feature called hairpinning, or NAT loopback, so that test can mislead. A check from outside shows what a friend sees.
If your internet provider gave you a combined modem and router and you run your own router behind it, the connection crosses two NATs. The rule then has to exist on both, or the provider's box has to be put into bridge mode, as Xbox and Plex both describe. More on that in the troubleshooting list below.
How to check if a port is open (port checker)
A port checker connects to your public address from outside, the way a friend would, and reports what it found. That makes it the port forwarding test to trust, because the router, the device's firewall and the provider all have to let the connection through. Search for "is my port open" and you will find many such tools, also called open port scanners.
packet.guru has a free open port checker for this. It checks the public IPv4 address of your home network, so find that address first. The packet.guru home page shows your public IPv4 address when you open it on a device in the same home network with any VPN turned off. A VPN, or a phone on mobile data, shows a different network's address. Compare it with the internet (WAN) address on your router's status page: if they differ, read the troubleshooting list below before you test anything.
The checker tests TCP ports, up to 10 per check, and reports each one as:
- OPEN: something accepted the connection. The rule works and the program is listening.
- closed: the connection reached a device that answered "nothing here", so nothing is listening on that port. The rule may be fine and the server not running, or the rule points at the wrong device.
- filtered/timeout: no answer at all. Something stopped the connection on the way: no rule, a firewall, a second router or the provider.
To check open ports over UDP, a port scanner has nothing reliable to go on, because UDP has no handshake to answer. Hytale's UDP 5520 is a typical case. For UDP, the real test is the game itself: ask a friend outside your network to join.
Port forwarding not working? Common causes
When a port checker says closed or filtered, go through these in order:
- The program is not running, or listens on another port. Start the server, then check its settings for the port.
- Wrong local address. The device got a new address after a restart and the rule points at the old one. A DHCP reservation fixes it for good.
- Wrong protocol. The rule is TCP and the game needs UDP, or the other way round.
- The device's firewall blocks it.
- Two routers, also called double NAT. Look at the internet (WAN) address on your router's status page. If it is a private address such as 192.168.x.x, 10.x.x.x or 172.16 to 172.31.x.x, another router sits in front of yours. Forward on both, or put the first one into bridge mode.
- CGNAT. If the router's WAN address is in the range 100.64 to 100.127, your provider most likely shares one public address between many customers, and no rule on your router can help. Starlink, for example, says its default IPv4 setup does not allow inbound traffic. What is CGNAT explains how to confirm it and how to get around it.
- The provider blocks the port. Some providers block certain ports on home lines, mail ports in particular. The provider's own list of blocked ports is the reference.
The NAT Type Test shows how your connection behaves for games, and it checks a WAN address you paste from your router's status page for both double NAT and CGNAT.
How to reach a home server without port forwarding
Port forwarding is not the only way to reach a server at home. These setups open no port on your router at all:
- A mesh VPN such as Tailscale. Your devices connect to each other directly through NAT, with a relay as a fallback when a direct path is not possible, and no port on the router is opened. Everyone who connects needs the app, which suits your own phone and a few friends. Hytale lists Tailscale as an alternative when port forwarding does not work.
- A tunnel. The server makes an outgoing connection to a service with a public address, and visitors connect to that service instead of your home. Cloudflare Tunnel works this way for websites and for private access by people who run Cloudflare's client software, but it is not a way to open a game server to ordinary players. ngrok offers TCP tunnels on its free plan once you add a payment card, with a random address.
- A rented server. A small VPS or a game host runs the server outside your home altogether.
These also work behind CGNAT, where port forwarding cannot.
FAQ
Is port forwarding the same as a VPN?
No. Port forwarding lets connections from the internet into one device at home. A VPN carries your own device's traffic through an encrypted tunnel to a VPN server. A VPN can replace port forwarding for remote access, because you connect into your home network through it instead of opening a port to everyone.
Is opening port 7777 safe?
A port number by itself is neither safe nor dangerous. Port 7777 is safe to forward if the program listening on it is a game server you trust and keep updated, and it goes to one device. Forwarding it "just in case", with nothing you know listening there, only adds a rule to forget.
How do I port forward on my PC?
The rule lives on the router, not on the PC. On the PC, keep its local address fixed (a DHCP reservation on the router is the easiest way) and allow the game or the server through the PC's firewall.
Is port forwarding hard?
The rule itself takes a minute. Most of the time goes into finding the right port and protocol, keeping the device's local address fixed, and finding out whether a second router or CGNAT is in the way.
Should I delete port forwarding rules I no longer use?
Yes. A rule you forgot points at whatever later listens on that port on that device. Remove it when the server goes away, and keep a short list of what you opened and why.
Sources
- RFC 3022: Traditional IP Network Address Translator (Traditional NAT) (IETF)
- Hytale Server Manual (Hypixel Studios)
- Network ports used by Xbox network (Xbox Support)
- How to set up port forwarding on a TP-Link router (TP-Link)