Port Forwarding Not Working? Diagnostic Wizard
Test the port from outside your network, then isolate whether the failure is the service, device firewall, router rule, ISP filtering, CGNAT, or double NAT.
Enter the public IP address or domain and the port you are trying to open. We test it from our servers, the way an external visitor would see it.
Before You Diagnose Port Forwarding
A forwarded port only works when each layer in the path is correct. Check these requirements before changing random router settings.
My IP
Enter the public IP address or domain and the port you are trying to open. We test it from our servers, the way an external visitor would see it.
Is the service running on the right device?
The application (game server, web server) isn't actually running or listening on that port. Ensure your software is started and configured to listen on the correct port and IP address (0.0.0.0 usually covers all interfaces).
Does the router rule point to the right device?
Your router doesn't know which device to send the traffic to. Log into your router's admin panel and configure port forwarding to direct traffic for that port to your computer's local IP address.
Does the device firewall allow this port?
Your computer's firewall (like Windows Defender) or a third-party security suite is blocking incoming connections. Create an inbound rule in your firewall settings to allow traffic on the specific port you are testing.
Match the Port Result to the Likely Cause
Use the external result pattern to choose the next diagnostic step instead of changing every setting at once.
| Result pattern | Likely cause | How to confirm | Next action |
|---|---|---|---|
| Closed | Service Not Running / Incorrect IP Address / Firewall Blocking | The application (game server, web server) isn't actually running or listening on that port. Ensure your software is started and configured to listen on the correct port and IP address (0.0.0.0 usually covers all interfaces). | Re-check after fixing |
| Filtered / Timeout | Router Configuration / ISP Blocking / Double NAT | If your router's WAN address does not match your public IP, you may be behind CGNAT or two routers. A single port forwarding rule will not be enough. | If your ISP blocks inbound traffic or uses CGNAT, you may need a static public IP, a VPS, or a VPN that supports port forwarding. |
| Does the router rule point to the right device? | Router Configuration / Incorrect IP Address / Double NAT | Enter the public IP address or domain and the port you are trying to open. We test it from our servers, the way an external visitor would see it. | Your router doesn't know which device to send the traffic to. Log into your router's admin panel and configure port forwarding to direct traffic for that port to your computer's local IP address. |
| Open / The port is open and accepting connections | If the app still does not work, check the connection address, password, or the app's own settings. | If the app still does not work, check the connection address, password, or the app's own settings. | If the app still does not work, check the connection address, password, or the app's own settings. |
Step-by-Step Diagnostic Path
The order matters: prove the service works first, then move outward through firewall, router, ISP, and NAT layers.
Check the port from outside
Enter the public IP address or domain and the port you are trying to open. We test it from our servers, the way an external visitor would see it.
Is the service running on the right device?
The application (game server, web server) isn't actually running or listening on that port. Ensure your software is started and configured to listen on the correct port and IP address (0.0.0.0 usually covers all interfaces).
Does the device firewall allow this port?
Your computer's firewall (like Windows Defender) or a third-party security suite is blocking incoming connections. Create an inbound rule in your firewall settings to allow traffic on the specific port you are testing.
Does the router rule point to the right device?
Your router doesn't know which device to send the traffic to. Log into your router's admin panel and configure port forwarding to direct traffic for that port to your computer's local IP address.
ISP Blocking
Some ISPs block common ports or inbound connections on residential plans. This often appears as timeout or filtered.
Do you have double NAT or CGNAT?
You have two routers connected (e.g., ISP modem + personal router), creating two layers of Network Address Translation. Set your ISP modem to 'Bridge Mode' or configure port forwarding on both devices to chain the connection through.
Confirm Service and Firewall Before Router Changes
Use these quick examples to prove whether the service and device firewall work before you edit router or ISP settings.
Confirm the service is listening
On Linux, this confirms that a TCP service is listening on port 25565 before you test forwarding from the internet.
ss -lnt | grep :25565Check the Windows inbound firewall rule
Use this to confirm Windows Firewall has an inbound rule for the tested port or application.
netsh advfirewall firewall show rule name=all | findstr 25565Test the service from another LAN device
If another device on the same network cannot connect, fix the service or device firewall before changing the router.
nc -vz 192.168.1.50 25565Router Rule Checklist
Most failed port forwarding setups come from one incorrect field in the router rule. Verify each field before testing again.
| Rule field | What to verify |
|---|---|
| Port | Enter the public IP address or domain and the port you are trying to open. We test it from our servers, the way an external visitor would see it. |
| Incorrect IP Address | Your router doesn't know which device to send the traffic to. Log into your router's admin panel and configure port forwarding to direct traffic for that port to your computer's local IP address. |
| Port | The application (game server, web server) isn't actually running or listening on that port. Ensure your software is started and configured to listen on the correct port and IP address (0.0.0.0 usually covers all interfaces). |
| Protocol | Ports use two main protocols to transport data: • TCP (Transmission Control Protocol): Reliable and ordered. It guarantees data delivery, making it perfect for web browsing (HTTP), email, and file transfers where accuracy matters. • UDP (User Datagram Protocol): Fast but less reliable. It sends data without checking if it arrives, making it ideal for real-time applications like online gaming, streaming, and VoIP where speed is critical. |
| Incorrect IP Address | Your router doesn't know which device to send the traffic to. Log into your router's admin panel and configure port forwarding to direct traffic for that port to your computer's local IP address. |
| Re-check after fixing | Restart the service and router so new rules are applied. |
CGNAT vs Double NAT vs ISP Blocking
These three problems look similar in a port checker, but the fix is different. Use the WAN IP and failure pattern to separate them.
| Problem | How to identify it | Best next action |
|---|---|---|
| ISP Blocking | Some ISPs block common ports or inbound connections on residential plans. This often appears as timeout or filtered. | If your ISP blocks inbound traffic or uses CGNAT, you may need a static public IP, a VPS, or a VPN that supports port forwarding. |
| CGNAT | If your router's WAN address does not match your public IP, you may be behind CGNAT or two routers. A single port forwarding rule will not be enough. | If your ISP blocks inbound traffic or uses CGNAT, you may need a static public IP, a VPS, or a VPN that supports port forwarding. |
| Double NAT | You have two routers connected (e.g., ISP modem + personal router), creating two layers of Network Address Translation. Set your ISP modem to 'Bridge Mode' or configure port forwarding on both devices to chain the connection through. | If your router's WAN address does not match your public IP, you may be behind CGNAT or two routers. A single port forwarding rule will not be enough. |
Fixes by Failure Layer
Apply the fix for the layer that failed, then run the external check again before changing anything else.
Is the service running on the right device?
On Linux, this confirms that a TCP service is listening on port 25565 before you test forwarding from the internet.
Does the device firewall allow this port?
Use this to confirm Windows Firewall has an inbound rule for the tested port or application.
Does the router rule point to the right device?
Enter the public IP address or domain and the port you are trying to open. We test it from our servers, the way an external visitor would see it.
ISP Blocking
If your ISP blocks inbound traffic or uses CGNAT, you may need a static public IP, a VPS, or a VPN that supports port forwarding.
Do you have double NAT or CGNAT?
If your router's WAN address does not match your public IP, you may be behind CGNAT or two routers. A single port forwarding rule will not be enough.
Still closed?
Test from a device outside your network, because internal tests can behave differently with NAT loopback.
Examples: Minecraft, Web Server, Camera/NVR
Apply the same diagnostic path to the common setups that usually trigger port forwarding problems.
Minecraft server
25565 TCPIf port 25565 is closed, confirm the Minecraft server is running, the local firewall allows Java or TCP 25565, and the router forwards TCP 25565 to the server device.
Web server or API
80 / 443 / 8080 TCPIf ports 80 or 443 are filtered, confirm the web server listens locally, then check router forwarding and whether your ISP blocks residential inbound web ports.
Camera or NVR remote access
Vendor TCP portIf the camera works on LAN but times out externally, reserve the camera or NVR local IP, forward only the required port, and rule out CGNAT or double NAT first.
Frequently Asked Questions
Next Diagnostic Tools
Use these tools only when they answer the next diagnostic question.