Port forwarding guide
1. Confirm the local service
Before changing the router, test the application on the local network. Confirm the server IP, port and protocol. The service must listen on the network address, not only 127.0.0.1. On Linux, ss -lnt shows TCP listeners; on Windows, Get-NetTCPConnection -State Listen lists listening ports. Local success does not prove external access.
2. Identify NAT and CGNAT
Compare the router WAN IPv4 with the public IP observed by the site. WAN addresses in 100.64.0.0/10 use shared space; 10/8, 172.16/12 and 192.168/16 are private. A mismatch can reflect CGNAT, double NAT, VPN or another exit. Use the assistant and confirm with the provider before changing rules.
3. Configure and test
Reserve a stable local server IP through DHCP. Create a rule with the correct external port, internal IP, internal port and protocol, for example TCP 25565 → 192.168.1.50:25565 for a compatible service. Allow the necessary traffic in the server firewall. Test from outside the LAN: NAT loopback may be unavailable. The checker tests TCP, not UDP.
4. Reduce exposure
Do not place the server in a DMZ or disable the whole firewall just to test. Prefer specific rules and remove them when unnecessary. For admin panels, databases and remote access, consider VPNs or IP allowlists. With CGNAT, discuss public IPv4, IPv6 or a suitable tunnel with your provider.