How to Test Port Forwarding (and Fix It When It Doesn't Work)

Port forwarding tells your router to send incoming traffic on a specific port to a specific device on your network. You set it up to host a game server, run a web app, reach a security camera, or connect to your machine from outside. The problem is that a rule in the router's settings page doesn't prove anything actually works — the only real test is to reach the port from the public internet. That's what a port forwarding tester does: it connects from an outside server to your public IP and port, exactly the way a real user or peer would. This guide walks through testing it correctly and fixing the common reasons a port stays closed.

First, start the service you're forwarding. A port only reads as open if something is actually listening behind it — a stopped game server or a web app that isn't running will always show closed, no matter how perfect the router rule is. So launch the app first and make sure it's bound to the right port.

Second, find your public IP. Open the What Is My IP tool from the device on your network — this is the address the internet sees, which is not the same as the 192.168.x.x address your device has locally. The Open Port Check tool pre-fills this for you automatically.

Third, run the test from outside. Enter your public IP and the forwarded port into the Open Port Check port forwarding tester and press Run. Because the check originates from our server, it's a genuine external test — the same vantage point a real connection would come from. Open means forwarding works; closed or a timeout means something in the chain is blocking it, and the next sections cover why.

The service isn't listening. This is the single most common cause. Confirm the app is running and bound to the correct port on the correct interface — an app bound only to 127.0.0.1 (localhost) will never accept outside connections even with forwarding set up. Bind it to 0.0.0.0 or the device's LAN IP.

The rule points to the wrong device. Port forwarding sends traffic to one internal IP. If that device's IP changed — which happens whenever DHCP hands out a new lease — the rule now points at nothing. Give the device a static IP or a DHCP reservation so its address never moves out from under the rule.

A firewall is blocking it. The device's own firewall (Windows Defender Firewall, ufw, iptables) can drop the connection after it clears the router. Add an inbound allow rule for the port on the device itself, then test again.

Wrong protocol. Rules are TCP, UDP, or both. Most services this tester checks are TCP; if you forwarded UDP only, a TCP test will fail. Match the protocol your service actually uses.

If everything above looks perfect and the port is still closed, you may be behind CGNAT (Carrier-Grade NAT). To conserve IPv4 addresses, many ISPs — especially mobile, some fiber, and most Starlink connections — put you behind a shared public IP. Your router's WAN address is itself a private range (100.64.x.x through 100.127.x.x is the giveaway), so incoming connections never reach your router at all and no amount of port forwarding will help.

To check: compare the WAN IP shown in your router's status page against what the What Is My IP tool reports. If they don't match, you're behind CGNAT. The fixes are to ask your ISP for a public/static IPv4 (sometimes free, sometimes a small fee), use IPv6 if both ends support it, or use a tunnel/relay service (like a VPN with port forwarding, Tailscale, or Cloudflare Tunnel) that establishes an outbound connection instead of needing an inbound one.

When a forwarded port won't open, work through it in this order so you don't chase the wrong thing. Confirm the service is running and listening on the device. Confirm the device's local firewall allows the port. Confirm the router rule targets the device's current IP and the correct protocol. Confirm your router's WAN IP matches your public IP (rules out CGNAT). Then re-run the Open Port Check test after each change so you know exactly which fix mattered.

If the host is reachable but the specific port times out, the Ping tool helps confirm the connection itself is alive while the port is being filtered. A methodical pass through these five checks resolves the large majority of "port forwarding not working" cases.

How do I know if my port forwarding is working? Start the service, then use an external port forwarding tester like the Open Port Check tool against your public IP and the forwarded port. Testing from inside your own network can give a false result — only an outside check proves the internet can reach you.

My port forwarding was working and suddenly stopped. Most often the target device got a new local IP from DHCP, so the rule now points at nothing. Set a static IP or DHCP reservation for that device. A changed public IP or an ISP move to CGNAT can also cause it.

Why does the port show open on my LAN but closed from outside? Testing from your own network checks the local side only. A proper test must come from the public internet, which is why the Open Port Check tool runs the check from an external server.

Do I need port forwarding at all? Only for inbound connections where the internet initiates the connection to you (hosting a server, remote access). Outbound connections and most consumer apps don't need it. Tunnel/relay tools can also avoid it entirely, which is the usual workaround for CGNAT.