Port Forwarding Explained (and Why Hosts Skip It)

What port forwarding is, how to set it up for a home game server, why it fails behind CGNAT, and why a rented server never needs it.

4 min read · Updated Sep 23, 2026 · By GuavaHost Team

Port forwarding is the router setting that lets people on the internet reach a game server running inside your home. This guide explains what it actually does, how to set it up, why it sometimes cannot work, and why a rented server skips the whole thing.

IPs, ports and NAT in plain words

• Public IP. The single address your whole home has on the internet, given to you by your ISP.
• Local IP. The private address your router gives each device inside the house. These usually start with 192.168., 10. or 172.16. to 172.31., and they mean nothing outside your network.
• Port. A numbered door on a device, from 0 to 65535. A game server listens on one or more of them, for example 25565 for Minecraft Java.
• NAT (network address translation). How your router shares one public IP between every device. It lets replies to connections your devices start come back in, but it drops unexpected incoming connections, because it has no idea which device they are for.

A game server needs exactly those unexpected incoming connections. Port forwarding is a rule that says: "anything arriving on this port, with this protocol, goes to this device."

Setting it up

Every router's menus look different, but the steps are the same.

1. Give the server machine a fixed local IP. In your router, look for DHCP reservation (sometimes called a static lease) and reserve the machine's current local IP. Otherwise the router may hand it a different address next week and your rule points at nothing.
2. Find the game's ports and protocol. Most games use UDP, some use TCP, and some need more than one port. Our TCP vs UDP ports guide lists the defaults.
3. Log in to your router. The admin address is usually printed on a label on the router, commonly 192.168.0.1 or 192.168.1.1.
4. Find the forwarding section. It may be called Port Forwarding, Virtual Server, NAT or Applications.
5. Create the rule. Enter the external port, the internal port (usually the same number), the protocol (TCP, UDP or both) and the server's local IP. Save.
6. Allow it through the computer's firewall. On Windows, the first time the server starts you usually get a prompt to allow it. If you dismissed it, add an inbound rule for the server program or port.
7. Test from outside your network. Have a friend join using your public IP and the port. You can also try from your phone on mobile data with Wi-Fi turned off.

That last point matters: many routers do not support "NAT loopback", so connecting to your own public IP from inside the house can fail even when the forwarding works perfectly for everyone else.

Why it fails

CGNAT (carrier-grade NAT) means your ISP shares one public IP across many homes. A router WAN address starting with 100.64. to 100.127. is a strong hint. You cannot forward ports through CGNAT yourself. Some ISPs will give you a public IP on request, sometimes for a fee.

Double NAT happens when your ISP's modem is also a router and you have your own router behind it. You either forward on both, or put the ISP device in bridge mode.

One more thing people check that they do not need to: online port checkers only test TCP. UDP has no handshake, so a checker cannot reliably tell whether a UDP port is open. For UDP games, a real join attempt is the test.

What about UPnP?

UPnP (Universal Plug and Play) lets programs on your network open ports on the router automatically, and some games use it. It is convenient, but it lets any program on your network open a door, including one you did not mean to trust, so many people turn it off and forward ports by hand.

Staying safe

• Forward only the ports the game needs. Never forward remote desktop or router admin ports.
• Keep the server software updated, since it is now reachable from the whole internet.
• Remember every player now knows your home IP. See hosting at home vs renting for what that means if someone decides to attack it.

Players joining a server never need to forward ports

This is a common myth. Joining a dedicated server is an outgoing connection, and routers always allow replies to outgoing connections. Only the machine running the server needs forwarding. If a friend "cannot join", the fix is on the host's side, not theirs.

Why a hosted server skips all of this

A rented server lives in a data centre on a public IP, with no home router in front of it. The host assigns ports to your server and opens them for you. On GuavaHost these are called allocations: your main connect address sits at the top of the panel, and any extra ports a game needs, such as a query port or the Don't Starve Together caves port, appear on the Network tab. There is nothing to forward, no CGNAT to fight, and your home IP never comes into it. See finding your server IP and port.

One habit to keep: each GuavaHost server gets its own port, which is often not the game's default. Always share the exact address from the panel.

Still stuck? Jump into our Discord at discord.gg/GuavaHost and the team will help you out.

• port forwarding
• router
• nat
• cgnat
• networking
• self-hosting

Still need help? Our team is online 24/7 to answer questions.

Contact support