Before creating a rule
- Follow the service documentation.
- Confirm the service is listening.
- Prefer DHCP reservation.
- Have the gateway and login guide ready.
Rule fields
| Field | Meaning | Check |
|---|---|---|
| Name | Identifies the rule | Make cleanup clear |
| External port | Public entry | Use required port only |
| Internal port | Service destination | Follow vendor docs |
| Local IP | Target device | Reserve it |
| Protocol | TCP/UDP | Match service |
| Enable/save | Active state | Disable later |
Forwarding versus triggering
Forwarding maps an always-available destination. Triggering creates a temporary mapping after outbound traffic. Neither is universally safer; use what the service supports.
Top 12 Most Forwarded Application & Game Server Sockets
| Application / Server | Default Port(s) | Protocol | Transport Purpose | NAT Forwarding Requirement |
|---|---|---|---|---|
| Minecraft (Java Edition) | 25565 | TCP | Standard dedicated player connections | Inbound port forward required on primary router. |
| Minecraft (Bedrock / Mobile) | 19132, 19133 | UDP | Cross-platform multiplayer query & game data | Inbound UDP forwarding required. |
| Steam / Source Engine (CS2) | 27015 | UDP / TCP | Source multiplayer game server coordination | Forward UDP 27015; TCP optional for RCON. |
| Call of Duty: Warzone / MW3 | 3074 | UDP / TCP | Demonware handshake for Open NAT matchmaking | Forward 3074 UDP to eliminate Strict/Moderate NAT. |
| FiveM (GTA V Dedicated) | 30120 | UDP / TCP | FXServer client sync and HTTP asset downloads | Forward both TCP and UDP on port 30120. |
| Rust Dedicated Server | 28015, 28016 | UDP / TCP | Player traffic (UDP) and RCON admin (TCP) | Forward UDP 28015 and TCP 28016. |
| Palworld Dedicated Server | 8211 | UDP | Unreal Engine 5 co-op survival multiplayer | Forward UDP 8211. |
| Plex Media Server | 32400 | TCP | Remote video streaming outside home LAN | Forward TCP 32400; verify remote access in settings. |
| Jellyfin / Emby Media | 8096 | TCP | Self-hosted media streaming web interface | Forward TCP 8096 (or 8920 HTTPS). |
| Home Assistant | 8123 | TCP | Smart home dashboard external access | Forward TCP 8123 (Prefer Tailscale or Cloudflare Tunnel). |
| WireGuard VPN Endpoint | 51820 | UDP | Encrypted tunnel gateway handshake | Forward UDP 51820 to host endpoint. |
| OpenVPN Gateway | 1194 | UDP | SSL/TLS encrypted VPN client tunnel | Forward UDP 1194. |
Verify externally
Test while the service is running from outside the LAN. Local hairpin tests can mislead. Use the port checker when available.
Failure checklist
Check listener, host firewall, reserved IP, port mapping, protocol, double NAT, CGNAT, VPN, ISP filtering and IPv6. Do not jump to DMZ or reset.
Cleanup
Restrict source access when possible, monitor the service and remove the rule when finished.
Frequently asked questions
Does every app need forwarding?
No. Many apps use outbound connections or relays.
Why does LAN testing differ?
Hairpin NAT, CGNAT and firewall behaviour can differ externally.
Is DHCP reservation useful?
It keeps the device address stable without risky manual network edits.
Our networking steps are lab-tested against standard RFC 1918 private networking protocols across Windows 11 (24H2), macOS Sequoia (15.1), iOS 18, and Android 15. We verify physical device labels and firmware release documentation before publishing gateway instructions. Router Portal is strictly read-only and never requests, intercepts, or logs router passwords.