Port forwarding not working? Check for double NAT and CGNAT

You forwarded the port, the game server or camera is listening, and from outside it still will not connect. Before blaming the firewall, check how many NATs sit between that device and the internet.

What NAT is doing

NAT (network address translation) lets every device in a house share one public address: the router rewrites each outgoing connection and remembers where to send the replies. Replies to connections you started always get back. A brand-new connection from outside has nowhere to go unless you add a port forward rule saying “anything arriving on port 25565 goes to 192.168.1.40”. Wirebook explains it simply in What is NAT?.

A port forward only works on the router that actually owns the public address. Put a second NAT in front of it and the rule never sees the traffic.

The two-minute check

1. Log in to your router (how) and find the WAN, Internet or Public IP address on its status page.
2. Open any “what is my IP” page, or run curl https://ifconfig.me.
3. Compare:

A traceroute tells the same story: tracert 1.1.1.1 (Windows) or traceroute 1.1.1.1. Two private hops before your provider means double NAT; a 100.64–127 hop means CGNAT.

Fixing double NAT

It usually happens when you add your own router or mesh system behind the box the provider sent. Pick one:

• Modem / bridge mode on the provider's box (often called Modem mode, Bridge or IP passthrough). Your own router then gets the public address and its port forwards work. The provider's Wi-Fi switches off.
• Access-point mode on your own router or mesh, so the provider's router does all routing and you forward ports there.
• Forward on both: on the outer router, forward the port to your inner router's WAN address; on the inner router, forward it to the device. Works, but every change needs doing twice.
• Last resort: put the inner router in the outer router's DMZ (send everything unmatched to it). Only point a DMZ at a router, never at a PC or console.

Double NAT also causes the two DHCP servers problem and the “NAT type: Moderate/Strict” warning on consoles.

Living with CGNAT

Many mobile, satellite, fibre and newer broadband providers use carrier-grade NAT because there are not enough IPv4 addresses. You cannot forward ports through it yourself. Options, roughly in order:

• Ask the provider for a public IPv4 address; some do it free on request, some charge for a static IP.
• Use IPv6 if your provider supports it: every device gets a public IPv6 address, and you allow the port in the router's IPv6 firewall instead of forwarding. Visitors also need IPv6.
• Use an outbound tunnel or mesh VPN: the device connects out to a relay or VPN service, so nothing needs to come in. This is how many home servers and cameras work behind CGNAT, and it avoids opening ports at all.

If there is only one NAT and it still fails

• The device's address changed: give it a DHCP reservation (and turn off its private Wi-Fi address for that network).
• Wrong protocol: many games need UDP as well as TCP.
• The device's own firewall blocks the port, or the app listens only on 127.0.0.1. Check with netstat -ano (Windows) or ss -ltnup (Linux): 0.0.0.0:PORT listens on every address.
• You are testing from inside the house. Many routers do not support “hairpin” NAT, so test from mobile data.
• Your provider blocks common ports such as 25, 80 or 445 on home lines; try a different outside port. See common port numbers.

Why does a forward rule matter at all? Wirebook's interactive lesson How does the router know which device asked? shows a router dropping a friend's unasked-for game connection, then delivering it once a forwarding rule is added.

Related

Console NAT type Strict or Moderate · Good ping and packet loss for gaming · Adding mesh Wi-Fi without double NAT · DHCP and IP address conflicts · Find a MAC address on any device · Public vs private IP address · Log in to your router (192.168.1.1) · Common port numbers explained

Questions

Published 9 November 2026.