How to Port Forward
Open your server's ports the safe way by hand, or let UPnP do it automatically.
Ports must be open on your router for people outside your network to reach your server. Open the ports your admin panel lists under Network → Ports (each row has a copy button). The panel always shows your server’s current ports, so if you changed the main port from its 443 default, forward exactly what it lists: don’t assume a number. There are two ways to do this: forward them manually, which is safer, or turn on UPnP to let the server do it automatically.
🤔 What a port forward is, and single ports vs ranges
A port forward is one router rule: “send traffic on this port to this machine.” Add a rule for each item the panel shows, exactly as written, pointed at your server’s local IP:
- A single port (e.g.
3478) forwards one number. - A range (e.g.
50000-50019) forwards a whole block. Enter it in the router’s start-end fields, not one rule per port. - Match the protocol shown (TCP, UDP, or Both). When unsure, Both is fine.
See portforward.com for a general primer.
Should You Host a Server?
⚠️ Is hosting right for your setup?
Making a server reachable from the internet only works, and only makes sense, when you control the network. Use a managed address instead if:
- You're on a network you don't own: public, cafe, hotel, dorm, office, or apartment-building / shared wifi. You can't safely change those routers, and opening them up isn't yours to do.
- You're behind CGNAT or your ISP blocks inbound ports. Direct hosting can't work no matter what you set.
- You'd rather not expose your home's public IP. A successful connection reveals it to whoever connects.
For any of these, let Orbitr Pulsar give your server a free, permanent address with no forwarding and your IP kept private, or route around it with a tunnel or reverse proxy: see Public Access.
Before You Start
Both methods need two things first:
- A fixed local IP for the server, so forwarding (and UPnP) keep pointing at the same machine. Set a static IP or a DHCP reservation. See Find Your IP and Make It Static for how, on every platform.
- Access to your router. Open your router’s address (its Default Gateway, often
192.168.1.1) in a browser and sign in. Not sure what that is? See Find Your Router’s Address.
💡 After any change, click Recheck
In the admin app, open Network → Ports and click Recheck at the top-right of the panel. It re-tests every port immediately, no restart needed. Run it after each step below.
I’m Not Sure
Open your router’s admin page (its Default Gateway). If you can find a Port Forwarding / Virtual Server screen, use Manual (recommended, works on nearly every router). If you only see a UPnP toggle and want the quick route, use UPnP.
When Neither Works
Forwarding only works on a router that owns your public IP. Two things break that:
- CGNAT: your ISP shares one public IP across many customers. Orbitr flags this under Security (the TLS panel). No router setting fixes it.
- Double-NAT: a second router sits in front of yours. Bridge the upstream device, or forward on both routers.
In both cases use a tunnel or reverse proxy instead, which works regardless: see Public Access.
Troubleshooting
Saved a rule but still can’t connect: confirm it points at the server’s current local IP (a missing DHCP reservation can shift it), that every port the panel lists is forwarded (singles and ranges), and that the Windows Firewall card on the same page isn’t blocking it.
A port shows “Listening” but friends can’t connect: the service is up on this machine, but that does not prove the router forwards it. Test from outside your network and check you are not behind CGNAT.
UPnP worked, then stopped: UPnP leases expire and a router reboot can drop them. Click Recheck to re-claim. Manual forwards never expire.
Related
- Public Access: Tunnels, Reverse Proxy: for CGNAT or a blocked port
- Custom Domain Setup: a permanent HTTPS address
What's next?
Custom Domain SetupOrbitr PulsarOptional
Optional cloud identity backup and sync, so your identity follows you across devices.