Port forwarding is easier when you treat it as a path: internet traffic reaches your public IP, the router maps a specific port to one private LAN address, and the server application must then be listening and allowed through the host firewall. If any layer is wrong, opening more random ports will not fix it.

Fix it step by step

1Identify the server's private LAN address

On the host, find its IPv4 address such as 192.168.x.x or 10.x.x.x. Create a DHCP reservation or other stable assignment so the address does not change after a reboot and break the router rule.

2Use the game's documented ports and protocols

Do not forward broad ranges by guesswork. Some servers use separate game, query, RCON, web, or companion-app ports, and TCP/UDP requirements can differ. Follow the official server documentation.

3Confirm the application is listening locally

Before testing the internet, prove the server starts cleanly and can be reached from the same machine or LAN where appropriate. A router cannot forward traffic to a server process that is not listening.

4Create the router mapping to the correct LAN IP

Map the required external port/protocol to the same internal port on the server's stable LAN address unless the server documentation explicitly calls for a different mapping.

5Allow the server through the host firewall

Router forwarding and Windows/Linux firewall rules are separate layers. Allow the server application or only the required ports rather than disabling the entire firewall.

6Test from outside your home network

Many routers handle hairpin/NAT-loopback differently, so testing your public IP from the same LAN can be misleading. Use a phone hotspot, remote friend, or external port/service test appropriate for the protocol.

7Rule out CGNAT

Compare the router's WAN/public address with the address shown by an external IP-check service. If they do not represent the same public connection and the ISP uses CGNAT, ordinary port forwarding may not make the host reachable.

8Document working rules instead of opening more ports

Once the server is reachable, keep a small table of purpose, protocol, external port, internal port, and host IP. Remove unused rules to reduce confusion and unnecessary exposure.

Frequently asked questions

Do I always need both TCP and UDP?

No. Use only the protocols required by the specific server. For example, Facepunch documents Rust game/query ports as UDP and RCON/Rust+ ports separately.

Why can I connect locally but friends cannot?

That usually means the server application is running but the public path is blocked by router forwarding, firewall rules, ISP/CGNAT, or an incorrect public address.

Should I use DMZ mode?

Not as a normal fix. A DMZ setting can expose far more of the host than necessary. Correct, narrow port rules are easier to audit and safer.

Official sources

These references were used to build and verify the troubleshooting order in this guide.

Related troubleshooting guides

Continue with closely related guides from the same topic hub.