You configured port forwarding on your router, entered the correct port, started your server, and somehow the port is still closed.

This is extremely common.

Port forwarding can fail because of a simple firewall rule, an incorrect local IP, double NAT, or something completely outside your control, such as CGNAT from your ISP.

The good news is that you can usually identify the problem in a few minutes.

In this guide, we'll walk through the most common reasons port forwarding doesn't work, how to detect CGNAT and double NAT, and what you can do if opening a port simply isn't possible.

Quick answer: why is my port forwarding not working?

If port forwarding is configured but your port is still closed, the most common causes are:

• Your server or application isn't running
• You're forwarding to the wrong local IP address
• You're using the wrong TCP or UDP protocol
• Your firewall is blocking incoming traffic
• Your device's local IP changed
• You have two routers creating double NAT
• Your ISP uses CGNAT
• Your ISP blocks inbound connections or specific ports

Before changing anything else, make sure your service actually works locally.

Then test whether the port is reachable from outside your network.

Check your port with the Portwarp Port Checker.

If everything on your router looks correct but the port remains closed, CGNAT or double NAT should be among the first things you check.

---

How port forwarding is supposed to work

Normally, your home network looks something like this:

Internet
   ↓
Public IP
   ↓
Router
   ↓
Port Forwarding Rule
   ↓
Your PC / Server
   ↓
Game Server or Application

For example, if you're hosting a Minecraft Java server on:

192.168.1.50:25565

your router might have a forwarding rule like:

External port: 25565
Internal IP:   192.168.1.50
Internal port: 25565
Protocol:      TCP

Someone connecting to your public IP on port 25565 reaches your router, which forwards the connection to your Minecraft server.

When any part of that path is broken, the connection fails.

And in some networks, your router doesn't actually have a public IP at all.

That's where CGNAT comes in.

---

Step 1: Make sure the server works locally

Before troubleshooting your router, make sure the service you're trying to expose is actually running.

If you're hosting something on port 25565, for example, first try connecting to:

localhost:25565

or:

127.0.0.1:25565

If another device on your local network needs to connect, test using the server's LAN address:

192.168.1.50:25565

If the service doesn't work locally, port forwarding isn't the problem yet.

Check that:

• The server is running
• The application is listening on the expected port
• The configured port is correct
• The service is listening on the correct network interface
• The correct TCP or UDP protocol is being used

Fix the local connection first, then continue.

---

Step 2: Check if the port is actually open

Once your server is running, test the port from outside your network.

You can use the free:

Portwarp Port Checker

Enter your public IP or hostname, the port you're trying to expose, and select TCP or UDP.

For example:

Host:     your-public-ip
Port:     25565
Protocol: TCP

If the port is reachable, your forwarding setup is probably working.

If it shows as closed, continue troubleshooting.

A port test only works when the application using that port is running. A closed result doesn't automatically mean your router configuration is wrong.

---

Step 3: Check the port forwarding destination

One of the easiest mistakes to make is forwarding traffic to the wrong device.

Your computer might originally have:

192.168.1.50

but after restarting your router, DHCP could assign it:

192.168.1.73

Your router may still be forwarding traffic to 192.168.1.50, where nothing is listening anymore.

Check your device's current local IP and compare it with your port forwarding rule.

On Windows

Open Command Prompt and run:

ipconfig

Look for:

IPv4 Address

On Linux

You can use:

ip addr

or:

hostname -I

If the IP changed, update your forwarding rule.

For a permanent solution, consider creating a DHCP reservation in your router so the server always receives the same local IP.

---

Step 4: Check TCP vs UDP

Ports aren't just numbers.

The protocol matters too.

Some applications use TCP, some use UDP, and others require both.

For example, forwarding:

25565 TCP

doesn't automatically forward:

25565 UDP

If your application requires UDP and your router only forwards TCP, connections using UDP will fail.

Check your server's documentation and make sure your router rule matches the required protocol.

This is especially important for game servers.

---

Step 5: Check your firewall

Your router might be forwarding the traffic correctly while your operating system blocks it afterward.

On Windows, check Windows Defender Firewall and make sure your server application or port is allowed through the firewall.

On Linux servers, check whether you're using something like:

ufw
firewalld
iptables
nftables

For example, you can inspect UFW with:

sudo ufw status

If the required port isn't allowed, incoming connections can still fail even with a correct router configuration.

---

What is Double NAT?

Double NAT happens when your connection passes through two devices performing NAT instead of one.

A common setup looks like:

Internet
   ↓
ISP Modem / Router
   ↓
Your Router
   ↓
Your Server

Both devices create separate private networks.

For example:

ISP Router
192.168.0.1
      ↓
Your Router
192.168.0.20 / 192.168.1.1
      ↓
Server
192.168.1.50

If you only configure port forwarding on your own router, the first router still doesn't know where to send the incoming connection.

The traffic never reaches your rule.

How to tell if you have Double NAT

Open your router's status or internet page and find its WAN IP.

If the WAN address looks like a private address such as:

10.x.x.x
192.168.x.x
172.16.x.x - 172.31.x.x

there is probably another NAT device before your router.

However, there is an important exception.

If the address is in:

100.64.0.0 - 100.127.255.255

you may be behind CGNAT, not simply another router in your house.

---

How to fix Double NAT

There are a few ways to fix double NAT.

Option 1: Put the ISP router in bridge mode

If supported, enable bridge mode on the modem/router provided by your ISP.

This lets your own router receive the internet connection directly instead of creating a second NAT layer.

Your network becomes:

Internet
   ↓
ISP modem in bridge mode
   ↓
Your router
   ↓
Server

You can then manage port forwarding from one router.

Option 2: Use access point mode

If you don't need your second router to perform routing, another option is putting it into Access Point mode.

This also removes one NAT layer.

Option 3: Forward the port through both routers

You can also configure forwarding twice.

For example:

ISP Router
25565 → Your Router

Your Router
25565 → Server

This can work, but it makes the network more complicated and easier to misconfigure.

Bridge mode is usually cleaner when available.

---

What is CGNAT?

CGNAT, or Carrier-Grade NAT, is when your ISP shares a public IPv4 address between multiple customers.

Instead of your router receiving its own public IPv4 address, the network can look like this:

Internet
   ↓
ISP Public IP
   ↓
ISP CGNAT
   ├── Customer A
   ├── Customer B
   ├── Customer C
   └── You
        ↓
     Your Router
        ↓
     Your Server

The important difference is that the NAT device blocking the incoming connection belongs to your ISP.

You can't configure it from your router.

That means you can create a perfect port forwarding rule at home and the connection can still never reach your network.

---

How do I know if I'm behind CGNAT?

A few signs commonly point to CGNAT:

• Port forwarding looks correct but ports remain closed
• Your router WAN IP doesn't match your public internet IP
• Your router receives an address between 100.64.x.x and 100.127.x.x
• Your ISP doesn't provide a dedicated public IPv4
• You're using mobile, 4G, 5G, or some fixed wireless connections

Portwarp also has a free tool specifically for this:

Check your connection with the CGNAT Detector

If your ISP uses CGNAT, changing more settings on your router usually won't solve the underlying problem.

---

How to fix CGNAT

Unlike normal port forwarding problems, CGNAT usually can't be disabled from your home router.

You have a few options.

Option 1: Ask your ISP for a public IPv4

Contact your ISP and ask whether they can provide:

• A public IPv4 address
• A static IPv4 address
• An opt-out from CGNAT

Some providers offer this for free, while others charge an additional monthly fee.

Availability depends entirely on the ISP.

Option 2: Use IPv6

If your application and everyone connecting to it support IPv6, you may be able to expose the service directly over IPv6.

However, this isn't always practical.

Not every application, game, network, or client has reliable IPv6 support.

Option 3: Use a tunnel

Instead of waiting for incoming traffic to reach your router, a tunnel reverses the connection model.

Your device establishes an outbound connection to a public network.

That means there is no inbound port forwarding rule that needs to pass through your ISP's CGNAT.

---

How to host a server without port forwarding

If you're behind CGNAT, don't have access to the router, or simply don't want to deal with NAT configuration, you can use Portwarp instead.

The connection looks like this:

Players / Users
       ↓
Public Portwarp Address
       ↓
Portwarp Network
       ↑
Outbound Connection
       ↑
Your PC / Server
       ↓
localhost:PORT

Your server continues running locally.

For example:

Local server:
127.0.0.1:25565

Portwarp gives you a public endpoint that other people can use:

example.pwrp.cc:18472

The Portwarp client connects outward to the Portwarp network and forwards traffic back to your local application.

Because the connection starts from inside your network, you don't need to:

• Open ports on your router
• Configure NAT rules
• Have router administrator access
• Have a dedicated public IPv4
• Ask other users to install Portwarp

Portwarp supports TCP and UDP tunnels, so it can be used for game servers and other self-hosted applications.

---

How to bypass port forwarding with Portwarp

Getting started is straightforward.

1. Start your local server

Make sure your application works locally first.

For example:

127.0.0.1:25565

2. Create a Portwarp account

Create a free Portwarp account.

No credit card is required to start.

3. Install Portwarp

You can use the desktop app or the Portwarp CLI depending on your setup.

Download Portwarp

If you're running a headless Linux server or prefer the terminal, you can also use the CLI.

4. Create your tunnel

Configure the tunnel with the same local port your application already uses.

For example:

Local host: 127.0.0.1
Local port: 25565
Protocol: TCP

You don't need to change the port used by your local server.

5. Start the tunnel

Once connected, Portwarp provides a public address.

For example:

myserver.pwrp.cc:18472

Share that address instead of your home IP.

That's it.

No router configuration is required.

---

Port forwarding vs tunneling

Both methods can make a local server accessible from the internet, but they work differently.

If you have a public IPv4 address and complete control over your network, traditional port forwarding may work perfectly well.

If you're behind CGNAT, double NAT you can't control, a restricted network, or a router you don't have access to, tunneling is often much easier.

---

Common examples

Minecraft server port forwarding not working

Minecraft Java normally uses TCP port 25565.

If your Minecraft server works on:

localhost:25565

but friends can't connect through your public IP, check your firewall, forwarding rule, double NAT, and CGNAT.

You can also skip router configuration entirely.

Read our full guide:

How to Host a Minecraft Server Without Port Forwarding in 2026

FiveM port forwarding not working

FiveM servers commonly use port 30120 and require the correct TCP and UDP configuration.

If FXServer works locally but players can't reach it externally, CGNAT or network restrictions may be preventing inbound connections.

Read:

How to Host a FiveM Server Without Port Forwarding in 2026

---

Frequently asked questions

Why is my port still closed after port forwarding?

The most common reasons are an incorrect local IP, firewall rules, the wrong TCP/UDP protocol, double NAT, or CGNAT.

First confirm that the application is running locally, then use a port checker to test external reachability.

Can CGNAT block port forwarding?

Yes.

With CGNAT, your router doesn't directly control the public IPv4 address used by your connection. Incoming traffic first passes through NAT infrastructure operated by your ISP.

Your router's port forwarding rules can't configure that upstream NAT.

Can I port forward behind CGNAT?

Traditional IPv4 port forwarding usually isn't possible through CGNAT unless your ISP provides a public IPv4 or another mechanism for receiving inbound connections.

A tunneling service such as Portwarp avoids this requirement by creating the connection outbound from your device.

Is 100.64.x.x CGNAT?

The IPv4 range:

100.64.0.0/10

covers:

100.64.0.0 - 100.127.255.255

and is reserved as shared address space commonly used for Carrier-Grade NAT.

If your router's WAN address falls inside this range, CGNAT is a strong possibility.

Is Double NAT the same as CGNAT?

No.

Double NAT normally means two routers or NAT devices are between your server and the internet.

You may be able to fix it by changing your own network configuration.

CGNAT happens upstream inside your ISP's network. You usually don't control the NAT device creating it.

Do I need port forwarding to host a game server?

Not necessarily.

Traditional self-hosting usually uses port forwarding, but a tunnel can provide a public endpoint without opening ports on your router.

Portwarp can expose TCP and UDP services through an outbound tunnel.

Does Portwarp work without a public IP?

Yes.

Portwarp's client creates an outbound connection from your device, so your home connection doesn't need its own public IPv4 address for the tunnel to work.

Do players need to install Portwarp?

No.

Only the person hosting the server runs Portwarp.

Other users connect using the public address assigned to the tunnel.

---

Stop fighting with your router

If port forwarding works on your network, there's nothing wrong with using it.

But if you've spent hours changing router settings only to discover you're behind CGNAT, double NAT, or an ISP that doesn't allow inbound connections, there is an easier option.

Keep your server running locally:

localhost:PORT

and let Portwarp provide the public endpoint.

Start with Portwarp for free

No port forwarding. No public IPv4 required. No credit card required.