Port forwarding: what it is and how it works

Your router treats every unrequested visitor like a stranger at the door. Port forwarding is the note that says "this one goes to the server room".

The short answer

Port forwarding is a rule in your router that sends incoming traffic for one external port to one port on one device in your home network [1]. Without such a rule, a router that does address translation drops unrequested incoming connections, because it does not know which device they are meant for. Our assessment: forward only the ports a service really needs, to a device with a fixed address, and only if your connection has a public address at all.

How it works

1. What the router does. A NAT router rewrites the private addresses of your home network [2] and the ports on the way out and remembers the pairing, so answers find their way back [1]. For a connection that starts outside there is no such entry. A forwarding rule creates one permanently: external port, protocol, internal address, internal port.
2. Ports and protocols. A port number tells the receiving device which program should get the data. TCP and UDP each have their own ports [4]. AVM's guide asks for the protocol, the port on the device and the port requested externally [3]. Read the service's manual for the right values.
3. A fixed target address. The rule points at an internal IP address. If that device gets a different address tomorrow, the rule hits the wrong machine or nothing. AVM therefore describes giving the device a permanent address when you set up port sharing [5]. The lexicon entry on DHCP reservation covers that step (see Related pages).
4. A public address is required. AVM states that the router must receive either an IPv6 address or a public IPv4 address from the provider for static port sharing to work [3]. Behind carrier-grade NAT, forwarding on your router reaches nothing from outside (see Related pages: CGNAT).
5. The device firewall counts too. If the service runs on a device with its own firewall, you must open it there as well [3].
6. UPnP is the automatic version. UPnP lets programs ask the router to open ports without you. CISA's alert on UPnP flaws advises users to disable UPnP where possible and to keep SSDP (1900/udp) and SOAP services away from untrusted networks such as the internet [6]. Our assessment: if a service needs a port, create the rule by hand so that you know what is open.
7. Fewer holes with a reverse proxy. Instead of opening a port per web service, you can forward one port to a reverse proxy that passes requests on to the right backend [7].

A homelab example

The Bytearium homelab runs rack servers (HPE ProLiant DL360 Gen9 and DL380 Gen10) and a QNAP NAS, as of 14 to 18 Oct 2026. We have not recorded which ports, if any, are forwarded, so we say nothing about that. As a general example, take a Minecraft Java server on your own machine. Its commonly used port is 25565 [8]. On a FRITZ!Box you would give the machine a permanent address, add a port sharing rule for TCP 25565 to that device, and allow the port in the machine's own firewall [3][5]. Then test from outside your network, for example on mobile data, because a test from inside only proves the local path.

Checklist

• Check first that your connection has a public IPv4 or an IPv6 address.
• Give the target device a permanent internal address before you create the rule.
• Write down service, protocol, port and date for every rule.
• Forward only the exact ports the service documents, not whole ranges.
• Open the same port in the device's own firewall.
• Test from a network outside your home, not from the inside.
• Disable UPnP on the router unless you know why you need it [6].
• Remove the rule when you stop the service.