Quick Summary
- Port forwarding (DNAT) maps an external port on your router's public IP to an internal device's IP and port
- Without it, inbound connections from the internet are blocked by NAT -- the router does not know which internal device to send them to
- Common uses: hosting game servers, web servers, remote access (SSH), and security cameras
The Problem: NAT Blocks Inbound Connections
As explained in the home network guide, your router uses NAT to let all your devices share one public IP address. When your phone sends a request to a website, the router creates a NAT mapping so it knows to forward the reply back to your phone. But what happens when someone on the internet tries to connect to your network, without your device initiating the connection first?
The router receives the packet on its public IP, but there is no NAT mapping for this unsolicited inbound connection. The router does not know which internal device (if any) should receive it. By default, the router simply drops the packet. This is actually a useful security feature -- it prevents random internet traffic from reaching your devices. But it also means you cannot host a server that other people can connect to.
Port forwarding solves this by creating a permanent rule: "any traffic arriving on my public IP at port X should be forwarded to internal IP Y at port Z." This is technically called DNAT (Destination NAT) because the router rewrites the destination address of the incoming packet from the public IP to the internal IP.
Interactive: Configure Port Forwarding
Choose an external port, internal IP, and internal port. Then click "Send Request" to see the DNAT rewrite.
How DNAT Works Step by Step
External Client Connects
A user on the internet connects to your public IP address (203.0.113.5) on port 80. Their packet has a destination of 203.0.113.5:80. This packet arrives at your router's WAN interface.
Router Matches DNAT Rule
The router checks its port forwarding table. It finds a rule: "Port 80 -> 192.168.1.100:80". The router rewrites the destination IP and port from 203.0.113.5:80 to 192.168.1.100:80. This is the DNAT (Destination Network Address Translation) operation.
Packet Delivered Internally
The modified packet is forwarded to the internal network. It arrives at 192.168.1.100 on port 80, where your web server is listening. The server processes the request and sends a response back to the router.
Reply Goes Back Through NAT
The server's reply has source 192.168.1.100:80 and destination set to the external client. The router reverses the NAT: it rewrites the source from 192.168.1.100:80 to 203.0.113.5:80, so the external client sees the reply coming from your public IP, unaware that an internal server handled it.
Common Port Forwarding Use Cases
Game Servers
Hosting a Minecraft server (port 25565), Valheim (2456-2458), or Counter-Strike (27015). Players connect to your public IP, and port forwarding routes them to your gaming PC. Without it, friends cannot join your server.
Web Servers
Running a personal website or development server at home. Forward port 80 (HTTP) and 443 (HTTPS) to your server's internal IP. Combine with a dynamic DNS service if your public IP changes.
Remote Access (SSH/RDP)
Forward port 22 (SSH) or 3389 (RDP) to access your home computer remotely. Security warning: always use strong passwords or key-based authentication, and consider using a non-standard port to reduce automated attacks.
Port Forwarding on Linux with iptables
On a Linux router, port forwarding is configured with iptables. The key command uses the nat table
and the PREROUTING chain. For example, to forward external port 80 to an internal web server at
192.168.1.100:
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100:80
You also need to allow the forwarded traffic through the FORWARD chain:
iptables -A FORWARD -p tcp -d 192.168.1.100 --dport 80 -j ACCEPT
And ensure IP forwarding is enabled: echo 1 > /proc/sys/net/ipv4/ip_forward. With nftables (the
modern replacement for iptables), the syntax is different but the concept is identical: match incoming packets
on a specific port and rewrite the destination.
Security Considerations
Every port you forward is a door into your network. If the service behind that port has a vulnerability, attackers can exploit it to gain access. Never forward ports for services you are not actively maintaining. Change default ports when possible (e.g., use port 2222 instead of 22 for SSH). Use fail2ban or similar tools to block brute-force attempts. Keep the forwarded service updated and patched.
Consider using a VPN instead of port forwarding for remote access. With a VPN, you connect to your home network as if you were physically there, without exposing any ports to the internet. WireGuard and OpenVPN are popular choices that are more secure than opening individual ports.
Alternatives to Port Forwarding
VPN Tunnel
Instead of exposing services, connect to your home via VPN. All traffic goes through the encrypted tunnel. WireGuard only requires one port (typically UDP 51820) and provides access to everything on your LAN.
Reverse Proxy / Tunnel Service
Services like Cloudflare Tunnel or ngrok create outbound connections from your server to a relay. No port forwarding needed. The relay server has a public IP and forwards requests to your server through the tunnel.
UPnP (Automatic)
Universal Plug and Play allows applications to automatically configure port forwarding rules on your router. Convenient but risky -- any application (including malware) on your network can open ports. Disable UPnP if you do not need it.
Common Mistakes
Forwarding to the Wrong IP
If your server's IP changes (DHCP assigns a different address), the port forwarding rule points to the wrong device. Always assign a static IP or a DHCP reservation to the server.
Firewall Blocking the Forwarded Port
The router forwards traffic correctly, but the server's local firewall (like Windows Firewall or iptables on Linux) blocks it. You need to open the port on both the router AND the server.
ISP-Level NAT (CGNAT)
Some ISPs use Carrier-Grade NAT, meaning your "public IP" is actually another private address. Port forwarding on your router is useless because the ISP's NAT also blocks inbound traffic. You need to request a real public IP from your ISP or use a tunnel service.
Frequently asked questions about port forwarding
What is port forwarding?
Port forwarding is a NAT rule that maps an external port on your router's public IP to a specific internal device and port. It lets unsolicited inbound traffic from the internet reach a server behind NAT, which would otherwise be dropped because there is no existing NAT mapping.
How does port forwarding work?
When a packet arrives at the router's public IP on a configured external port, the router performs Destination NAT (DNAT): it rewrites the destination address and port to the internal target. Reply packets from the internal host pass back through the router, which reverses the translation so the remote client sees the public IP.
What is the difference between port forwarding and a VPN?
Port forwarding exposes a single service directly to the internet, so anyone who knows the address can probe it. A VPN instead lets you authenticate first and then reach any internal service over an encrypted tunnel, which is generally safer for remote access to a home or office network.
Why does my port forwarding not work?
The most common causes are CGNAT (your ISP gives you a non-routable public IP), a firewall on the internal host blocking the service, the target device using a DHCP address that has changed, or the service binding to localhost instead of all interfaces. Verify each layer in order.
Is port forwarding safe?
Every forwarded port is a permanently open door into your network, so safety depends on the exposed service. Keep it patched, use strong authentication, prefer non-default ports for management services like SSH, and disable UPnP so applications cannot open ports without your knowledge.
Try port forwarding
You just learned how DNAT rules let inbound connections reach a server behind NAT. Now build one yourself: add a port forward, trace a connection from outside, and follow the rewrite hop by hop in both directions. Press Go Live and the rule runs as real iptables NAT.
Launch the port forwarding lab →