Port Forwarding Not Working? Fix Closed Ports Step by Step
Find the first broken link between your app and the public internet, then apply the right fix instead of changing every router setting.
Quick Answer: Why Port Forwarding Is Not Working
Port forwarding usually fails because the service is not listening, the rule points to the wrong local IP or protocol, the host firewall blocks it, or Double NAT and CGNAT stop the connection upstream. Prove the service works on the LAN, check the exact TCP or UDP rule, then test from cellular data and compare the router WAN address with the public IP. If the local setup is correct but you do not want to keep fighting the router and ISP path, a VPN that explicitly supplies an incoming port can give a compatible app a reachable endpoint.
Interactive troubleshooting
Port Forwarding Fix Finder
Answer these questions in order. The result points to the earliest problem, because later router changes cannot repair an app or firewall that is already blocking the connection.
Is the app or server running while you test?
A port checker reports Closed when no program is accepting a connection, even if the router rule is correct.
Can another device on your home network connect?
Use the host's private address and port from a second device on the same network.
Does the rule use the current device address, exact port and correct protocol?
The destination address must stay reserved, and TCP is not interchangeable with UDP.
Does the device firewall allow the app or port?
Router forwarding and the computer firewall are separate checks; both must allow the connection.
Does the router's Internet/WAN address match your public IPv4 address?
A mismatch usually means another router, an ISP gateway or CGNAT is in front of your router.
Are you testing from outside your Wi-Fi?
Use mobile data or a different internet connection. Some routers cannot loop a public connection back inside.
Start with the first question
Keep the app running during the entire test, then answer each question from top to bottom. Stop at the first No and fix that item before continuing.
Fix Port Forwarding in This Order
Each test proves one part of the path. Do not skip directly to CGNAT or buy a workaround until the service works locally and the router rule has been verified.
1Confirm that something is listening on the port
Open the app and confirm the port in its own settings. For a TCP service, the commands below show whether port 25565 is accepting connections; replace 25565 with your port. An empty result means the app is not listening there. UDP does not use the same listening test, so check the app log and configuration as well.
Windows PowerShell
Get-NetTCPConnection -State Listen -LocalPort 25565macOS / Linux
lsof -nP -iTCP:25565 -sTCP:LISTEN2Prove that the service works inside your network
From a second device at home, connect to the host's private address and service port. If that fails, check whether the app is bound only to 127.0.0.1 or localhost, whether it started successfully, and whether the host firewall permits connections from your home network.
3Verify every field in the router rule
The destination must be the host's current private address. Reserve that address in DHCP so it does not change. Match the documented internal port, external port and TCP or UDP protocol. If the router has both Port Forwarding and Port Triggering, use Port Forwarding for a service that must remain reachable.
4Add a narrow inbound firewall rule
Allow the app when possible, or allow only its required port and protocol. Also check security software that installs its own firewall. A brief disabled-firewall test can identify the cause, but turn protection back on immediately and create the proper exception.
5Compare the router address with the public address
Open the router's Internet or WAN status page and compare its IPv4 address with the public IPv4 shown by an external checker. A private address, an address from 100.64.0.0 to 100.127.255.255, or a different address means there is another translation layer to investigate.
6Test from outside, with the service still running
Use mobile data or another internet connection. Test the current public IPv4 and external port, not the host's private address. A browser test proves only a web service; a generic online port checker usually tests TCP and cannot prove that a UDP-only game service works.
7Rule out ISP filtering and address changes
If every earlier check passes, map a high external port such as 49152 to the same internal service port and test again. If the high port works, the ISP or a network policy may filter the original port. If nothing works, ask the ISP whether inbound traffic is blocked and whether your line receives public IPv4.
What Each Symptom Usually Means
| What you see | Most likely cause | Best next test |
|---|---|---|
| The checker says Closed immediately | The app is not listening, the firewall rejects the connection, or the rule targets the wrong device. | Start the service and test its private address from another home device. |
| It works at home but not from the internet | The local service is healthy; focus on the router rule, public address, Double NAT or CGNAT. | Continue with the upstream-address check above. |
| It worked before and suddenly stopped | The host's private address or your public address changed, the app selected a new port, or a router update removed the rule. | Recheck the current addresses, app port and saved router rule. |
| A TCP checker passes but the game or app still fails | The service also needs UDP, another documented port, authentication or a separate discovery port. | Check the official port list and test inside the app instead of relying only on a TCP checker. |
| The port closes after connecting a VPN | The VPN route bypasses the router's public address, or the VPN server does not support inbound forwarding. | Use a VPN location that supports port forwarding and configure the exact port assigned by the VPN. |
| Friends can connect only sometimes | The public address changes, the host sleeps, the app stops, or the private address reservation is missing. | Keep the host awake, reserve its private address and confirm the current public address before each test. |
When the Problem Is Before Your Router
A second home router can usually be bridged or configured to forward the same port twice. CGNAT is different: the additional router belongs to the ISP, so you cannot add the missing public rule yourself. Confirm which situation you have before changing more local settings.
When local rules cannot work
VPN and FRP Workarounds
These methods create a reachable entry point outside your home network. They do not change the NAT setting on your home router, and the right choice depends on how many ports and protocols the service needs.
VPN with inbound port forwarding
Best when an app can use the one or few public ports assigned by the VPN. Enter the assigned port in the app and keep the VPN connected. A normal privacy VPN without inbound forwarding will not help.
FRP through a public server
Consider FRP when you want to spend less and need specific TCP or UDP ports behind CGNAT. It is the programmer route: you must administer a public server, firewall rules, FRP configs, security and updates.
Public IPv4 from the ISP
Best when you want normal router port forwarding. A dynamic public IPv4 is enough for forwarding; pay for a static address only when the address itself must never change.
VPN Options When Router Forwarding Still Fails
Only three providers in this comparison currently document the incoming-port feature needed to bypass a blocked router or CGNAT path. The application must listen on the port supplied by the VPN.
Why these three made the shortlist. Each publishes current port-forwarding documentation plus trust or independent audit evidence. Sources were checked July 31, 2026; supported plans, platforms and locations can change.
Proton VPN
PureVPN
Some links on this page are affiliate links, meaning we may earn a commission at no extra cost to you. This helps keep NAT Checker free, but it doesn't affect what we recommend.
Lower-cost technical option: run FRP on a public server
If minimizing monthly cost matters, a small public server with FRP may cost less than a full VPN subscription and can expose specific TCP or UDP ports behind CGNAT. Choose it only if you have programmer or server-administration skills: you must configure Linux, firewall rules, FRP client and server files, access protection, monitoring, and security updates. Check the region, bandwidth and traffic charges before paying.
Open Only What the Service Needs
- Forward the smallest documented port or range. Do not expose every port to make a test pass.
- Keep the router, operating system and exposed application updated.
- Use strong, unique credentials and multi-factor authentication when the service supports it.
- Never expose the router administration page, file sharing or remote desktop only for convenience.
- Remove temporary rules and retest after changing the application or moving it to another device.
Frequently Asked Questions
Technical References
These references define the address ranges and firewall behavior used by the checks above.
Do not change everything at once
The fastest diagnosis is a chain of proof: app running, local connection working, correct rule, firewall allowed, public path available, then an outside test. The first failed check is the problem to solve.