Port forwarding fails most often because there are two routers (double NAT), your provider uses shared addresses (CGNAT), the device's IP changed, or a firewall on the device blocks it. Before opening ports, consider whether a VPN or cloud access is safer.
Common causes
Double NAT
The forward is on your router, but the provider's modem-router in front of it doesn't pass the traffic through.
CGNAT from the provider
Some providers share one public address among many customers, so incoming connections can't reach you.
Device IP changed
The forward points to an old address after the device received a new one.
Firewall on the device
The computer or server's own firewall blocks the incoming connection.
Testing from inside the network
Many routers don't allow you to test the public address from inside the office.
How to fix it, step by step
- 1
Reserve the device's IP
Give the device a DHCP reservation so the forward always points to the right place.
- 2
Compare the router's WAN IP to your public IP
If they differ, you have double NAT or CGNAT.
- 3
Put the provider modem in bridge mode
Or forward the port on both devices if bridge mode isn't available.
- 4
Allow it on the device firewall
Make sure the server or device firewall permits the connection.
- 5
Test from outside
Use a phone on mobile data, not office WiFi, to test.
When to call a technician
Every open port is a door into your network. We help decide whether a port forward is really needed, set it up securely if it is, or replace it with a VPN or cloud access that doesn't expose your office.
On-site support across Orange County · see our business networking and WiFi installation services.
Frequently asked questions
What is CGNAT?
Carrier-grade NAT shares one public IP among many customers. Incoming connections and port forwarding won't work unless the provider gives you a dedicated public IP.
Is port forwarding safe?
It can be risky. Never forward Remote Desktop or management ports, and keep any exposed device fully updated.
Why can't I test the port from inside the office?
Many routers don't support NAT loopback. Test from outside the network instead.