Port forwarding on a TP-Link Deco BE63, the step that lets a game server, a camera or a remote desktop reach a device from the internet, depends on three things being right: the device's address, the forwarding rule and the internet connection, and most failures are with the third. This is a Wi-Fi 7 tri-band mesh system managed entirely through the Deco app, so the rule is made in the app and not on a web page. First give the target device a fixed address.
The checks in more detail
In the Deco app, open More, Advanced, Address Reservation, and reserve an address for the device so that it always receives the same address; a rule that points at an address that changes will break. Then create the rule. In the app, choose More, Advanced, NAT Forwarding, then Port Forwarding, and add a rule: name it, select the device, set the internal port, the external port, and choose the protocol, TCP, UDP or both, as the application requires. The external port is the one that people on the internet use, and the internal port is the one the device listens on.
Save the rule. If it still does not work, test whether the device itself is listening: the firewall on the device must allow the port, and the application must be running. Test from outside the home network, using a phone on mobile data or an online port checker, since testing from inside often fails because of how some routers handle the loop back. Check that your internet connection has a public address: if the Deco's internet address begins with 100.64 or is private,
or if your provider uses carrier-grade NAT, no forwarding will work, and you need to ask for a public address or use a service such as a relay. If the Deco sits behind another router or a modem router, you have a double NAT and must forward on both or use bridge mode on the first. A changing public address can be handled with dynamic DNS. If the rule seems right and the port still shows closed, restart the Deco and contact TP-Link with the serial number.
Differential
Likely causes of “TP-Link Deco BE63 mesh port forwarding is not working”, and how to tell them apart
- 1
A device without a fixed address
What separates it The rule stops working after a restart
How to confirm Reserve an address for the device
- 2
A rule with wrong ports or protocol
What separates it The port shows closed
How to confirm Match the application's ports and protocol
- 3
A device firewall or app not listening
What separates it The router rule is right and the port is closed
How to confirm Allow the port and run the application
- 4
Carrier-grade NAT or a private WAN address
What separates it No rule works from outside
How to confirm Ask for a public address
- 5
A double NAT
What separates it The rule works from the second router only
How to confirm Use bridge mode or forward on both
Before you touch a setting
Record this first — changing settings destroys the evidence
- The application and its ports
- The device's address
- The Deco's WAN address
- Whether a second router is in front
Try in this order
0 of 6 completedReserve an address
ReversibleFor the device.
Add the rule
ReversibleIn NAT Forwarding.
Match ports and protocol
ReversibleAs the application needs.
Allow the port
ReversibleIn the device firewall.
Test from outside
ReversibleOn mobile data.
Check the WAN address
ReversibleFor carrier-grade NAT.
Model-specific
What is true of this model and not of its siblings
- A fixed address
- The rule points at one address, so reserve it.
- Ports and protocols
- They must match the application.
- Testing
- Test from outside the network.
- Carrier-grade NAT
- It blocks forwarding entirely.
- Double NAT
- A second router needs a second rule or bridge mode.
- TP-Link help
- Quote the serial number.
Stop boundary
When this stops being a self-service repair
- !Do not forward ports to an insecure device
- !Close rules you no longer use
- !Contact TP-Link if the port stays closed
Evidence ledger
Sources behind this answer
Exact questions
Common questions
How do I forward a port on a Deco?+
Reserve an address, then add a rule in the app.
Why is the port still closed?+
The device, a double NAT or carrier-grade NAT.
What is a public address?+
One the internet can reach.
Should I test from inside?+
No, test from outside.
What if my address changes?+
Use dynamic DNS.