Port forwarding in plain English
Your router ignores unexpected visitors by design. Port forwarding is how you tell it “this one’s for me” — for game servers, cameras, and remote access.
6 min read · Reviewed July 2026
Think of your home network as an apartment building with one street address — your public IP. Mail arrives addressed to the building, and the router is the doorman deciding which apartment gets it. When you browse the web, the router remembers you started the conversation and routes replies back to you. But when a stranger knocks uninvited — someone trying to join your game server, or you checking your security camera from work — the doorman’s default answer is to pretend nobody’s home.
Port forwarding is a standing instruction to the doorman: anything arriving for door number 25565, send to the PC in the office. That’s the entire concept.
Ports, in one paragraph
A port is just a numbered door, 1 to 65535, on every address. Different services listen on different numbers by convention: websites on 443, Minecraft on 25565, remote desktop on 3389. The number doesn’t do anything magical — it’s how one machine runs many services without the mail getting mixed up.
The three-step setup
First, give the device a fixed address inside your network (a ‘static lease’ in router settings) so the forwarding rule doesn’t break when addresses reshuffle. Second, in the router’s port forwarding page, create the rule: external port, internal address, internal port, protocol (TCP, UDP, or both — the app’s docs will say). Third, test from outside your network — your phone on mobile data works — because testing from inside often lies to you.
If it doesn’t work, check the usual suspects in order: the device’s own firewall, a typo in the internal address, and then the big one — CGNAT. If your provider has you behind shared addressing, no router setting will fix it, because the blockage is upstream. We have a whole guide on checking that.
The security part people skip
Every forwarded port is a door from the internet to one device, open 24/7 to anyone who knocks. Bots scan the entire internet for common ports constantly — forward 3389 to a Windows machine and you’ll see login attempts within hours. So: forward only what you need, delete rules when you’re done with them, keep the exposed device updated, and never forward a port to a device with a default password.
My opinion: for personal remote access in 2026, a tunneling tool like Tailscale beats port forwarding for safety and usually for setup time. Port forwarding still wins for public-facing things — a game server your friends join without installing anything. Know which case you’re in before opening doors.