TP-Link's port forwarding guide is precise. In the Deco app go to More, Advanced, NAT Forwarding, Port Forwarding, tap the plus icon or Add Port Forwarding Rule, choose a Service Type or Custom and name it, tap Internal IP to select the device, enter the External Port and Internal Port, and Save. If the Internal Port is blank it matches the External Port. Deco does not accept a manually typed internal IP;
The checks in more detail
the device must be connected and have an address to appear. Some models allow up to 64 entries. Reserve the device's address first so it does not change: More, Advanced, Address Reservation, plus icon. To verify, find the WAN IP under More, Internet Connection, IPv4 and try WAN IP:External Port from an outside network. If the WAN IP is private, another NAT device is upstream and must forward the port as well.
Port forwarding is not available in Access Point mode. Common ports are 80 for HTTP, 21 for FTP, 25 for SMTP and 110 for POP3. To delete a rule, hold the entry in the list and remove it. Also check the service is running and that the device's own firewall allows it. Test a forward from outside your network, for example from a phone on cellular data, because a test from inside the home can pass or fail for unrelated reasons. Keep the service's software patched, since an open port is the first thing internet scanners find.
Write each rule's purpose in the service name so you can tell them apart in a year, and remove any you cannot explain, since stale forwards are a risk that costs nothing to close.
Differential
Likely causes of “TP-Link Deco mesh wifi port forwarding is not working”, and how to tell them apart
- 1
A changed device IP
What separates it The rule points at the wrong address because the device's IP address changed
How to confirm Reserve the address for the device in the Deco app, so that the rule keeps pointing at it
- 2
Double NAT
What separates it The ports stay closed because a second router in front is also doing NAT
How to confirm Open the ports on the upstream device too, so that traffic can reach the Deco
- 3
Access Point mode
What separates it There is no port forwarding because the Deco is in Access Point mode
How to confirm Use Router mode, since port forwarding is not available in Access Point mode
- 4
A device firewall
What separates it The port is blocked because the firewall on the device itself stops the traffic
How to confirm Allow the port in the device's own firewall, as well as in the Deco's port forwarding
- 5
A wrong port or protocol
What separates it The service is unreachable because the port or the protocol in the rule is wrong
How to confirm Check the ports that the service needs, and correct the rule to match them
Before you touch a setting
Record this first — changing settings destroys the evidence
- The device, its IP and the ports
- The WAN IP and whether it is public
- The result of testing the port from outside your network
Try in this order
0 of 7 completedReserve an address
ReversibleReserve an address for the device by going to More, then Advanced, then Address Reservation.
Open Port Forwarding
ReversibleOpen Port Forwarding by going to More, then Advanced, and then NAT Forwarding in the app.
Add a rule
ReversibleAdd a rule by choosing a service, the internal IP address of the device and the ports.
Save
ReversibleSave the rule, and then test that the port is open from a device outside your network.
Check the WAN IP
ReversibleCheck the WAN IP address by going to More, then Internet Connection, and then IPv4.
Test from outside
ReversibleTest from outside by using the WAN IP address and the port number, from another network.
Delete unused rules
ReversibleDelete unused rules by holding the entry in the list and choosing to delete it.
Model-specific
What is true of this model and not of its siblings
- Entries
- Entry limits vary by model.
- Reservation
- Address Reservation is under More, Advanced.
- Other models this page answers
- These steps also fit the Deco XE75 mesh, Deco X55 mesh, Deco M5 mesh.
Stop boundary
When this stops being a self-service repair
- !If the port stays closed with a reserved IP, check for double NAT and provider blocks
- !If the app cannot save, contact TP-Link support
- !If the service works inside but not outside, check the WAN IP
Evidence ledger
Sources behind this answer
App path, fields, verification and deletion.
Fixing an IP address.
Common reasons a forward fails.
Router versus Access Point features.
The company and its products.
Exact questions
Common questions
Where do I set it?+
More, Advanced, NAT Forwarding, Port Forwarding.
Can I type the internal IP?+
No, you cannot type the internal IP address, and you pick a connected device from the list.
What if the internal port is blank?+
If the internal port is left blank, it matches the external port automatically.
How many rules?+
Some models allow up to 64.
What if the WAN IP is private?+
If the WAN IP address is private, another NAT device sits upstream of the Deco.
Which port is HTTP?+
HTTP uses port 80, which is the port that web servers listen on by default.
Which port is FTP?+
FTP uses port 21, which is the port that its control connection listens on.