You added a forwarding rule for TCP 25565, but the port checker says the port is closed. Your router's WAN address is 100.88.4.20. What is the most likely cause?

The ISP uses carrier-grade NAT, so incoming connections never reach your router 100.88.4.20 is inside 100.64.0.0/10, the shared address space for CGN, so the public address belongs to the ISP's translator.

Why does a home router drop an unexpected incoming connection by default?

Because NAT only creates mappings for outgoing sessions, so there is no device to send it to RFC 3022 describes traditional NAT sessions as outbound; inbound ones need a static mapping, which is what port forwarding adds.

Which change removes the need for address translation for a home server?

Using IPv6, where each device has its own public address With IPv6 only a firewall rule is needed; there is no shared address to translate.

Module 1: IP addresses and your connectionLesson 4 of 136 min read

Port forwarding and CGNAT: why your server can't be reached

You start a game server, a home camera or a media server, and it works on your own network. Friends outside get nothing. The cause is almost never the program. It is the address translation that lets a whole household share one public IPv4 address, and in some cases a second translator run by the ISP. This lesson follows a connection from the internet to a device and shows where it stops.

Ports: the second half of an address

An IP address gets a packet to a device; a port number gets it to one program on that device. TCP and UDP ports run from 0 to 65535. RFC 6335 divides them into three ranges: System or Well Known Ports (0 to 1023), User or Registered Ports (1024 to 49151), both assigned by IANA, and Dynamic or Ephemeral Ports (49152 to 65535), which are never assigned and are used for short-lived outgoing connections.

A web server listens on port 443, a Minecraft Java server usually on 25565. When someone connects, they need both: the public IP address and the port.

Why incoming connections stop at the router

A home router uses what RFC 3022 calls NAPT, Network Address Port Translation: many private addresses and their ports are translated into one public address with different ports. When a laptop opens a connection, the router records the mapping and rewrites replies back to the laptop.

RFC 3022 is explicit that in traditional NAT, sessions are one-directional, outbound from the private network. Sessions in the other direction are only allowed by exception, using static mappings for chosen hosts. A packet that arrives on a port with no mapping has nowhere to go, so the router drops or refuses it.

A port forwarding rule is a static mapping

Port forwarding, also called a virtual server in some router menus, is that static mapping. You tell the router: anything arriving on public port 25565 goes to 192.168.1.50, port 25565.

Worked example: a game server at home

Server: 192.168.1.50, listening on TCP 25565. Router's public address: 203.0.113.45. Rule: TCP 25565 → 192.168.1.50:25565. A friend connects to 203.0.113.45:25565; the router rewrites the destination to 192.168.1.50:25565 and the server answers. Three things still have to be true: the server program is running, the server's own firewall allows the port, and the device keeps the same local address (reserve it in the router's DHCP settings).

When the router isn't the last translator

Some ISPs put many customers behind one public IPv4 address with a carrier-grade NAT (CGN) in their own network. RFC 6598 reserves 100.64.0.0/10, that is 100.64.0.0 to 100.127.255.255, for the link between the CGN and customers' routers. Your router then has a WAN address in that range, and the public address belongs to the CGN, shared with other subscribers.

A forwarding rule on your router only works for traffic that reaches your router. With CGN, an incoming connection reaches the ISP's translator first, which has no mapping for it. RFC 7021, a report on tests of CGN with real applications, found that peer-to-peer gaming and direct SIP calls failed behind it: some applications never send outgoing traffic first, so no mapping is created, and applications that need one fixed port fail when several subscribers behind the same address want that port.

Two-minute CGNAT check

1. Open your router's status page and note its WAN or internet IPv4 address. 2. Open What is my IP and note the IPv4 address. 3. If they differ, or the router's address is in 100.64.0.0 – 100.127.255.255 or a private range, something between you and the internet translates again, and a forwarding rule on your router cannot open the port.

Ways around it

RFC 7021 lists the Port Control Protocol (PCP, RFC 6887) as a possible workaround. PCP lets a device ask a NAT or firewall how to translate and forward incoming packets, which can include the ISP's CGN, but only if the ISP supports it. In practice, the usual routes are:

Ask the ISP whether it can give your connection its own public IPv4 address.
Use IPv6 if your ISP provides it: each device has its own public address, so only a firewall rule is needed, not translation.
Use a relay or tunnel service that accepts the connection on a public address and passes it to you through an outgoing connection.

Check whether a TCP port on your connection is reachable from outside. Start the program first, then type the port in Port number or pick it from Common ports and press Check. The result shows Your IP, the port and whether it is Reachable from the internet; for a closed port, the reason line separates a timeout from a refused connection. The test uses TCP, so a service that only listens on UDP can't be checked this way.

Port checker

Quick check

Three questions. Pick an answer to see why.

You added a forwarding rule for TCP 25565, but the port checker says the port is closed. Your router's WAN address is 100.88.4.20. What is the most likely cause?
Show the answer
Answer: The ISP uses carrier-grade NAT, so incoming connections never reach your router 100.88.4.20 is inside 100.64.0.0/10, the shared address space for CGN, so the public address belongs to the ISP's translator.
Why does a home router drop an unexpected incoming connection by default?
Show the answer
Answer: Because NAT only creates mappings for outgoing sessions, so there is no device to send it to RFC 3022 describes traditional NAT sessions as outbound; inbound ones need a static mapping, which is what port forwarding adds.
Which change removes the need for address translation for a home server?
Show the answer
Answer: Using IPv6, where each device has its own public address With IPv6 only a firewall rule is needed; there is no shared address to translate.

Standards, not guesses

These guides explain how the internet's plumbing works, using the published standards (RFCs) and official documentation. Each guide shows the date it was last checked.

Sources

Last checked October 28, 2026

Results come from public DNS, registry and certificate data and from checks run from Cloudflare's network at the moment you ask. They can differ from what another network sees. How our tools work · Terms of use.