The scenario
Game-Server (192.168.1.50) runs a Minecraft Java Edition server, which listens on TCP port 25565 by default. It sits behind Home-Router, whose public address is 203.0.113.50. Friend (203.0.113.100) is out on the internet and knows only the public network 203.0.113.0/24. Home-Router already translates your LAN's outgoing connections to 203.0.113.50, so you can reach the internet. It has no port forward yet, so when Friend connects to 203.0.113.50:25565 the router treats the connection as one for itself, and nothing on the router listens on that port.
What you will work out
Learn to create a port forward (DNAT) that exposes one service behind NAT, and see that it opens exactly one port to exactly one host.
Why this matters
'How do I let my friends join my server?' is one of the most common home networking questions, and the usual answer is a port forward to a server that is really running (unless the ISP puts the router behind carrier-grade NAT, as in Two Layers of NAT). The same mechanism is behind Docker's 'docker run -p 25565:25565', which installs a DNAT rule on the host. Two things can still get in the way outside your router: a host firewall on the game server itself, and carriers that put your router behind their own NAT, in which case your router's WAN address is in 100.64.0.0/10 and a forward on your own router cannot be reached from the internet.
Running it
Port Forward: Gaming Server opens on a canvas, already wired and addressed. Trace a packet through it hop by hop, or run the same topology live on real Linux network namespaces. How the two modes differ.
Open Port Forward: Gaming Server
Runs in your browser. No install, no signup, and the simulation starts instantly.
Open the lab →