Search guides

Fix a port forward that will not work

We'll verify the internal IP, port mapping, and protocol, rule out firewall and NAT, then get the port forward working or tell you when to escalate.

Troubleshooting · Wi‑Fi & networking
15–30 min
What you'll need
  • Access to the router (to view and edit port forwards)
  • Access to the internal device (to check IP, firewall, listening port)
  • A way to test from outside (phone on cellular or canyouseeme.org)
Step 1 of 9

Quick triage — pick your path

Quick triage — pick your path

Choose the option that matches what you see. You can jump straight to that section.

Show full guide

Steps

Goal: Verify internal IP, port forward mapping, and device firewall, then test from outside.

  • Confirm the internal device has a fixed IP (static or DHCP reservation).
  • Verify the port mapping: external port, internal port, internal IP, protocol (TCP/UDP).
  • Check the device firewall allows inbound traffic on that port.
  • Good: Port open from outside. Bad: Still closed—check double NAT or call support.

Verify internal IP and mapping

Goal: Confirm the port forward targets the right device and port.

  • In the router, open the port forward or NAT settings. Check internal IP matches the device.
  • Confirm the port matches the application (e.g. 3389 RDP, 25565 Minecraft). Protocol must be TCP or UDP as required.
  • Good: Mapping correct. Bad: Wrong—edit the rule.

Check device firewall

Goal: Ensure the device accepts inbound traffic on the port.

  • On the device, open firewall settings. Add an inbound rule for the port (TCP or UDP) or allow the application.
  • Good: Rule added. Bad: Firewall blocking—add the rule.

Test from outside

Goal: Verify the port is open from the internet.

  • Disconnect from Wi‑Fi on a phone and use cellular. Or use canyouseeme.org. Enter the external port.
  • Good: Port open. Bad: Port closed—check double NAT, power-cycle router, or call support.

When to get help

Call the router manufacturer or ISP if:

  • The port mapping is correct, the device firewall allows the port, and the port is still closed from outside.
  • The ISP may block inbound ports (common on some residential plans).

Verification

  • The port shows open on canyouseeme.org or similar from outside the network.
  • The application is reachable from the internet (e.g. RDP connects, game server is joinable).
  • No firewall or router errors.

Escalation ladder

Work from the device outward. Stop when the problem is fixed.

  1. Fixed internal IP Ensure the device has a static IP or DHCP reservation.
  2. Port mapping Verify external port, internal port, internal IP, protocol.
  3. Device firewall Allow inbound traffic on the port.
  4. Test from outside Use canyouseeme.org or phone on cellular.
  5. Call support Router manufacturer or ISP if config is correct.

What to capture if you need help

Before calling support or posting for help, have these ready. It speeds everything up.

  • Internal device IP and whether it is fixed
  • Port forward rule (external port, internal port, internal IP, protocol)
  • Application and port it listens on
  • Whether the port is open from outside (canyouseeme.org result)
  • Steps already tried

Does the internal device have a fixed IP?

Port forwards target a specific IP. DHCP can change it.

Check the device IP. Set a static IP or add a DHCP reservation on the router. Good: device always has same IP. Bad: IP changes—fix it.

Yes No

You can change your answer later.

Fix internal IP

Set a static IP on the device or add a DHCP reservation on the router. Update the port forward to use that IP. Power-cycle the router.

Done

Is the port mapping correct?

External port, internal port, internal IP, protocol must match the app.

In the router, check the port forward rule. Internal IP = device IP. Port = app port (e.g. 3389 RDP, 25565 Minecraft). Protocol = TCP or UDP. Good: all correct. Bad: wrong—fix the rule.

Yes No

You can change your answer later.

Fix port mapping

Edit the port forward: set internal IP to the device, external and internal port to the app port, protocol to TCP or UDP. Save and power-cycle the router.

Done

Does the device firewall allow the port?

The device firewall can block inbound traffic.

On the device, add an inbound firewall rule for the port (TCP or UDP). Or allow the application. Good: rule added. Bad: firewall blocking—add rule.

Yes No

You can change your answer later.

Fix firewall

Add an inbound rule to allow the port. Restart the app. Test from outside.

Done

Test from outside the network

Testing from inside can fail due to NAT.

Use canyouseeme.org or a phone on cellular. Enter the external port. Open: forward works. Closed: check double NAT, ISP blocking, or router issue—call support.

Yes No

You can change your answer later.

Port forward works

The port is open from outside. The application should be reachable.

Done

Call support

Config is correct but port still closed. Router or ISP may block inbound ports. Call router manufacturer or ISP with port number and protocol.

Done

Reviewed by Blackbox Atlas

Frequently asked questions

Why would a port forward not work?
Common causes are wrong internal IP (device got a new IP from DHCP), wrong port or protocol, device firewall blocking inbound traffic, or testing from inside the network (NAT hairpinning may not work). The internal device must have a fixed IP and the correct port must be open.
What is the difference between external and internal port?
External port is what the internet sees; internal port is what the device listens on. Often they match (e.g. both 3389 for RDP). Some routers let you map external 8080 to internal 80 if the device uses port 80.
Can I test a port forward from inside my network?
Testing from inside can fail because of NAT—the router may not route traffic from your LAN back through the port forward. Use an external service (e.g. canyouseeme.org) or a phone on cellular to test from outside.

Rate this guide

Was this helpful?

Continue to