Forwarding fails when the target IP changes, the service is not listening, host firewall blocks it, double NAT/CGNAT exists, or testing occurs from inside without loopback support. Reserve the target's address in the router so it stays the same. Check that the service is listening locally and that the firewall allows it.
Differential
Likely causes of “Router port forwarding is configured but not working”, and how to tell them apart
- 1
The target device's local address changed
What separates it The forward worked and then stopped after a restart, and the device now has a different address than the rule.
How to confirm Reserve the target's address in the router so it stays the same.
- 2
The service is not listening or a firewall blocks it
What separates it The forward is correct but the service is not running or the device's firewall drops the traffic.
How to confirm Check that the service is listening locally and that the firewall allows it.
- 3
The internet connection is double NAT or carrier-grade NAT
What separates it The router's WAN address is a private or shared address that differs from the address shown on an external checker.
How to confirm Compare the router's WAN address with the public address an external site shows.
- 4
The test was made from inside the network
What separates it The forward works from outside but not from a device on the same network, since the router does not support loopback.
How to confirm Test from a cellular connection or another external network.
Before you touch a setting
Record this first — changing settings destroys the evidence
- The service, the port and the protocol, and the target device's local address.
- The router's WAN address and the public address shown by an external checker.
- Whether the test was made from inside or outside the network.
Try in this order
0 of 4 completedCapture the exact symptom
ReversibleConfirm the service listens locally on the target device and record its current LAN and public WAN addresses.
Run the smallest isolation test
ReversibleReserve the target IP, allow the service in its firewall and compare the router WAN address with an external address.
Correct only the proven cause
ReversibleRemove double NAT or request a public address where appropriate; expose only the required authenticated service.
Verify before changing anything else
ReversibleTest from a separate cellular connection and inspect service logs.
Stop boundary
When this stops being a self-service repair
- !Expose only the authenticated service you need and keep it updated, since an open port is reachable from the internet.
Evidence ledger
Sources behind this answer
Exact questions
Common questions
Why does port forwarding work for some people and not for me?+
Your provider may use shared addressing, or a second router may add a second layer of translation. Check the router's WAN address against your public address.
Why does port forwarding fail?+
The device IP may change, the ISP may block ports or a double NAT may exist.
Is CGNAT a factor?+
Yes, some providers block inbound connections.