Exposed host (router)

A port forward lets one specific visitor through the front door. An exposed host leaves the door open and points everyone to the same room.

The short answer

An exposed host is a router setting that sends incoming internet connections to one chosen device, without you opening its ports one by one. On a FRITZ!Box, the router forwards everything that no other port sharing rule claims [1][2]. While it is active, the router firewall no longer protects that device [1][2]. Our assessment: use an exposed host for a short test or for a router with its own firewall behind your router, and never for a PC, NAS or game server that has no firewall of its own.

How it works

1. The default is closed. The FRITZ!Box firewall rejects unsolicited data from the internet, and all TCP and UDP ports of the router are closed. To reach a device from outside, you configure port sharing [3]. This follows the idea of traditional NAT, where sessions start inside and inbound access needs a static mapping [6].
2. What the setting does. It sends all requests from the internet to the specified device, unless another rule applies [2]. Incoming connections to destination ports that have their own IPv4 port sharing rule go to the device in that rule, not to the exposed host [1].
3. One host per address family. For IPv4 you can enable an exposed host for only one device. For IPv6 it can be enabled for all devices. You can choose IPv4, IPv6 or both [1].
4. It needs a reachable router. The FRITZ!Box must get an IPv6 address or a public IPv4 address from the provider [1]. Port sharing needs a public IP address in general, and devices behind the router can only be reached if the router itself can be reached from the internet [3]. Our reading: behind double NAT or carrier-grade NAT, the setting on your router does not change that.
5. Not a DMZ. AVM notes that an exposed host is often confused with a DMZ, a separate network zone that the internet and the home network can reach, while a firewall blocks access from the DMZ to the LAN. The FRITZ!Box does not support a DMZ [1].
6. When it is meant to be used. AVM says it can make sense when you run another router with an integrated firewall behind the FRITZ!Box and that router offers server services [1]. As a test, AVM suggests setting a device with a failing static port sharing briefly as exposed host: if access then works, the port sharing was configured wrongly [3].
7. What the authorities say. AVM advises using it only for testing and sharing just the ports an application needs [1][2][3]. The BSI generally recommends being very sparing with port forwards and, for NAS web servers, avoiding risky forwards entirely in favour of a VPN [4]. The BSI technical guideline for secure broadband routers requires that the firewall contains no port forwarding rules in its initial state [5].

A practical example

You run your own firewall router behind the FRITZ!Box at 192.168.178.2. In the FRITZ!Box you open the port sharing for that device and enable the exposed host option for IPv4, as described in AVM's knowledge base (menu names can differ with the FRITZ!OS version) [1]. From then on, unsolicited IPv4 traffic ends at your firewall router, which decides what gets through. We have not documented a router chain in our inventory (14 to 16 Oct 2026), so this is a generic walk-through.

Checklist

• Try a normal port sharing rule first and keep the exposed host as a fallback [3][4].
• Choose an exposed host only for a device that runs its own firewall [1][2].
• Give that device a fixed address, so the entry cannot point to the wrong device later.
• Remove the setting after a test [1][3].
• Pick IPv4, IPv6 or both on purpose [1].
• Test from outside, for example over mobile data, and see which ports answer.
• Prefer a VPN for remote access to home devices [4].