Port forwarding: what it is and how to set it up

Do you want to reach a home camera, server or game running at your home even when you are away? This is where port forwarding comes in. It is a useful tool, but it must be used carefully. Let us explain what it is and how to set it up safely.

Why it is needed at all

Your devices at home have local (private) IP addresses that are not directly visible from the internet. The router hides them behind one public IP address via the NAT mechanism. When you want to reach a specific device from outside, the router needs to know where to send the traffic. Port forwarding handles this.

What port forwarding is

Port forwarding is a rule on the router that says: send incoming traffic on a given port from the internet to a specific device and port on the local network. Thanks to this you can reach, for example, a home server from outside. When creating the rule you also specify the TCP or UDP protocol (or both). Most services use TCP, but some applications and games require UDP, so it pays to know what the given service needs.

When you actually need it

Port forwarding makes sense when you want to make a specific device reachable from the internet:

• Your own server or website running at home.
• Home cameras or a NAS you want to reach remotely.
• A game server your friends connect to.
• Remote access to a computer on your home network.

If you are dealing with none of this, there is no need to open a port, and it is safer that way.

How to set it up

1. Find the local IP address of the device you want to reach (for example a server or camera).
2. Set a fixed IP for the device (a DHCP reservation) so it does not change.
3. Log in to the router and find the Port Forwarding or Virtual Servers section.
4. Create a rule: the external port, the device’s internal IP address and the internal port.
5. Save and test access from outside, for example from mobile data.

Safety first

By forwarding a port you are opening your device to the internet, and therefore to attackers too. Therefore:

• Open only what you really need and close the port when finished.
• Never expose cameras and devices with weak passwords directly. A hacked camera is a common case.
• Use strong passwords and up-to-date software, this relates to securing the router.
• Consider a safer alternative.

When it does not work: CGNAT

Sometimes you set the rule correctly and still cannot connect from outside. A common cause is CGNAT (a shared public IP). In this mode the operator does not give each customer their own public IP address but shares it among several. Port forwarding on your router then does not help, because traffic from outside does not reach you at all. The solution is usually to ask the operator for a public IP address (sometimes for a fee) or to choose an entirely different approach.

A safer alternative: VPN

In many cases it is better to use a VPN instead of opening ports. It connects you securely into your home network, and you reach devices as if you were at home, without exposing ports to the internet. For a home server (NAS) this is often the best solution.

Need secure remote access to devices on your network? Get in touch, we will design a solution without unnecessary risk.

This article is part of our Computer networks overview.