Port Forwarding: How Incoming Connections Get Through a Router or a VPN

Port forwarding is a rule on a gateway, a home router, firewall or VPN server, that takes traffic arriving at its public address on one port and passes it to a specific device and app behind it. Without such a rule, the gateway lets through only replies to your own requests and drops connections strangers start. The feature is also called port mapping, and technically it is an application of network address translation (NAT).

What a port actually is

A port is a number from 0 to 65535 that tells a machine which program should receive a packet. A few numbers everyone meets: 443 for HTTPS, 22 for SSH, 25565 for a Minecraft server. The gateway reads that number, checks its rules and passes the packet inward or discards it.

What people open ports for

Seeding is the classic reason. A torrent client without a reachable port can still download, yet only from peers who are themselves reachable, and two unreachable peers cannot connect to each other, so thin or old swarms crawl. Hosting is the second: when you are the one running the Minecraft world, friends connect to your machine. The third is remote access to a NAS, a Raspberry Pi, a camera or an SSH box. Ordinary online matches run through the publisher's servers and gain nothing, and a forward never lowers ping.

On your router versus through a VPN

Some providers allow forwarding only on their P2P servers. One practical trap: the assigned port often changes after a reconnect, so the torrent client or server config needs updating. Also disable UPnP and NAT-PMP in the torrent software; otherwise it keeps requesting a door from the home router, and that conflicts with the port assigned by the VPN. A port checker reports "open" only while an app is actually listening.

Why so many VPN services removed it

An open port on a shared server address lets any customer host anything under the provider's IP. Mullvad said in its 2023 removal announcement that people used forwarded ports to run undesirable content and malicious services, which brought law enforcement contacts, blacklisted server IPs and hosting providers cancelling contracts. Every customer behind that address inherits the blocklist entries caused by one abuser. There was a privacy hole as well, Port Fail, disclosed in 2015: a customer with a forwarded port on the same server could trick your device into revealing your real IP. Some providers that still forward ports say their setup is protected against it.

The risk of an open port

An open port is visible to every scanner on the internet, and bots probe it for weak passwords and outdated software. The danger sits in the app behind the number: an unpatched server, a default login, a remote-desktop tool with a weak credential. Update the app, give it a strong login, forward only the ports you use and close them when done. The VPN hides your home IP and soaks up junk traffic sent at a hosted server, but it does nothing for an unpatched app.

Port forwarding and a dedicated IP

Some providers open ports only on a dedicated IP or a dedicated server. Because the address belongs to one customer and never changes, the endpoint your friends connect to stays stable, and abuse traces to a single account. The trade-off: you lose the cover of blending into a shared crowd, which matters for anonymous browsing but rarely for hosting.

When no provider gives you a port

A mesh VPN connects your own devices directly. A tunnel service or a reverse SSH tunnel to a rented server exposes a local app over a connection you start, so no inbound rule is needed at all.

How many VPNs offer it

Of the 377 services in the main ranking, 31 state they offer port forwarding, 91 say they do not, and 255 do not mention it. See the VPN port forwarding ranking for the breakdown.

FAQ

Is port forwarding safe?

Only as safe as whatever program listens behind the port.

Does port forwarding make games faster?

No. It only matters when you host the server yourself; matchmaking and ping gain nothing.

How do I check that a port is open?

Start the app so something listens on the port, then test from an outside network or an online checker.

Short answer

Port forwarding is a NAT rule that sends traffic arriving on one public port to one chosen device and app. On a router you pick the number and reveal your own IP, and it fails behind CGNAT. Through a VPN, the provider hands you a port on a shared address, which hides your home IP. Many providers dropped the feature or never offered it, and some that stayed require a dedicated IP for it.