You added the forwarding rule, the game or camera or server still cannot be reached, and every port test says closed. This is one of the most common problems we have ever helped people through, and it almost always falls to one of nine causes. A reader named Steve once spent two weeks of evenings fighting his router over one port, and the actual fix took half an hour once he worked through it in order instead of guessing. That order is what this page is for.
A forwarded port only tests open when every link in the chain agrees: the program is listening, the computer’s firewall allows it, the router sends the traffic to the right machine, and the internet can actually reach your router. Check them in that sequence and you cannot miss.
1. Make sure something is listening first. A port with no program behind it tests closed even when the forwarding is perfect. Start the game, camera software, or server, then confirm on that machine that it is really listening. On Windows, netstat -ano in a command prompt will show the port with a process ID next to it. If it is not listed there, forwarding is not your problem yet.
2. Forward to an address that cannot move. Routers hand out local addresses by lease, and leases expire. If your rule forwards to 192.168.1.50 and the computer picked up .51 after a reboot, everything silently breaks. Give the device a fixed address, either a reservation in the router or a static setting on the device, before you trust any rule pointing at it. This one break causes more “it worked yesterday” complaints than everything else combined.
3. Match the protocol. A rule for TCP does nothing for a program that talks UDP, and plenty of games and camera systems use both. When in doubt, look the port up to see what normally runs there, or set the rule to both protocols while you test.
4. Let it through the computer’s own firewall. The router can deliver traffic perfectly and Windows Defender Firewall (or your security suite) will still drop it at the front door. You need an inbound rule on the target machine for the port or the program. This layer catches a lot of people because the router rule feels like the whole job. It is half of it.
5. Test from outside, not from your own chair. Many home routers cannot take a request aimed at their public address and bend it back inside. Tested from your desk, the port looks closed; tested from the internet, it is fine. Use a phone with Wi-Fi off so it is on cellular, or ask a friend across town. First confirm your public IP, then test against that address from the outside connection.
6. Make sure you actually have a public address. This is the one no router setting can fix. Some providers, satellite and cellular providers especially, put entire neighborhoods behind one shared public address. It is called carrier-grade NAT. One reader spent days forwarding ports for his security cameras before his ISP admitted the whole customer base sat behind a private address, and inbound connections could never arrive. The tell: the WAN address shown inside your router does not match what what’s my IP shows, or it starts with 10. or 100.64 through 100.127. Your options are a public or static IP from the provider (sometimes a small monthly fee), IPv6 if both ends support it, a tunnel or VPN service that hands you a reachable port, or the camera vendor’s own relay service.
7. Check for double NAT. If your ISP’s modem is also a router and your own router sits behind it, a forward on one box dies at the other. Log into the modem: if its WAN side shows your public address and your router’s WAN side shows a private one like 192.168.0.x, you have two routers routing. Either put the modem in bridge mode or create the forward on both.
8. Ask whether your ISP blocks the port. Home plans commonly block port 25, and some block 80, 8080, and a few others. If one specific well-known port refuses to open while a random high port forwards fine, the provider is the suspect. Moving the service to another port is usually the fastest fix.
9. Look for a port conflict. Only one program can own a port at a time. A reader we knew as Captain Cookie got his file sharing forwarded and working, then found his web browser dying every morning; the sharing program had grabbed port 80 for itself, and letting go of that one setting fixed both. If a port behaves strangely, the netstat command from step 1 tells you exactly which process holds it.
A word about UPnP
Many programs skip all of this by asking the router to open ports automatically through UPnP. Convenient, but it cuts both ways: rules appear without you knowing, they can collide with rules you made by hand, and every one of them is a hole. Whether the rule came from you or from UPnP, the router’s forwarding table is worth reading top to bottom now and then. If an entry is a mystery, look up the port and decide whether it deserves to be there. A good firewall blocks everything by default; forwarding is you making exceptions, so make them on purpose and keep the list short.
When the port finally tests open from the outside, you are done, and when you retire the game or camera, close the rule behind it. For a wider look at what your connection shows the world, start at the firewall test page, and if a result surprises you, why port checks fail explains what open, closed, and silent really mean.