TP-Link · port forwarding

TP-Link Deco BE63 mesh port forwarding is not working

TP-Link Deco BE63 mesh port forwarding is not working: local service, firewall, reserved IP, double NAT, CGNAT and provider blocks should be proved in order. Scoped to Deco BE63.

Port forwarding on a TP-Link Deco BE63, the step that lets a game server, a camera or a remote desktop reach a device from the internet, depends on three things being right: the device's address, the forwarding rule and the internet connection, and most failures are with the third. This is a Wi-Fi 7 tri-band mesh system managed entirely through the Deco app, so the rule is made in the app and not on a web page. First give the target device a fixed address.

The checks in more detail

In the Deco app, open More, Advanced, Address Reservation, and reserve an address for the device so that it always receives the same address; a rule that points at an address that changes will break. Then create the rule. In the app, choose More, Advanced, NAT Forwarding, then Port Forwarding, and add a rule: name it, select the device, set the internal port, the external port, and choose the protocol, TCP, UDP or both, as the application requires. The external port is the one that people on the internet use, and the internal port is the one the device listens on.

Save the rule. If it still does not work, test whether the device itself is listening: the firewall on the device must allow the port, and the application must be running. Test from outside the home network, using a phone on mobile data or an online port checker, since testing from inside often fails because of how some routers handle the loop back. Check that your internet connection has a public address: if the Deco's internet address begins with 100.64 or is private,

or if your provider uses carrier-grade NAT, no forwarding will work, and you need to ask for a public address or use a service such as a relay. If the Deco sits behind another router or a modem router, you have a double NAT and must forward on both or use bridge mode on the first. A changing public address can be handled with dynamic DNS. If the rule seems right and the port still shows closed, restart the Deco and contact TP-Link with the serial number.

Differential

Likely causes of “TP-Link Deco BE63 mesh port forwarding is not working”, and how to tell them apart

  1. 1

    A device without a fixed address

    What separates it The rule stops working after a restart

    How to confirm Reserve an address for the device

  2. 2

    A rule with wrong ports or protocol

    What separates it The port shows closed

    How to confirm Match the application's ports and protocol

  3. 3

    A device firewall or app not listening

    What separates it The router rule is right and the port is closed

    How to confirm Allow the port and run the application

  4. 4

    Carrier-grade NAT or a private WAN address

    What separates it No rule works from outside

    How to confirm Ask for a public address

  5. 5

    A double NAT

    What separates it The rule works from the second router only

    How to confirm Use bridge mode or forward on both

Before you touch a setting

Record this first — changing settings destroys the evidence

  • The application and its ports
  • The device's address
  • The Deco's WAN address
  • Whether a second router is in front

Try in this order

0 of 6 completed
  1. Reserve an address

    Reversible

    For the device.

  2. Add the rule

    Reversible

    In NAT Forwarding.

  3. Match ports and protocol

    Reversible

    As the application needs.

  4. Allow the port

    Reversible

    In the device firewall.

  5. Test from outside

    Reversible

    On mobile data.

  6. Check the WAN address

    Reversible

    For carrier-grade NAT.

Model-specific

What is true of this model and not of its siblings

A fixed address
The rule points at one address, so reserve it.
Ports and protocols
They must match the application.
Testing
Test from outside the network.
Carrier-grade NAT
It blocks forwarding entirely.
Double NAT
A second router needs a second rule or bridge mode.
TP-Link help
Quote the serial number.

Stop boundary

When this stops being a self-service repair

  • !Do not forward ports to an insecure device
  • !Close rules you no longer use
  • !Contact TP-Link if the port stays closed

Evidence ledger

Sources behind this answer

Exact questions

Common questions

How do I forward a port on a Deco?+

Reserve an address, then add a rule in the app.

Why is the port still closed?+

The device, a double NAT or carrier-grade NAT.

What is a public address?+

One the internet can reach.

Should I test from inside?+

No, test from outside.

What if my address changes?+

Use dynamic DNS.

Wrong device or version?

Match the path before repeating the steps.

Match another device