How to open a port on a Wi-Fi router: from theory to practice

1. Open the section Forwarding → Virtual Servers.
2. Click Add and fill in the fields:
   • Service port: the port to open (eg. 25565 For Minecraft).
   • Inland port: usually the same as external (unless the application requires otherwise).
   • IP address: local IP of the device (for example, 192.168.0.100).
   • Protocol: select TCP, UDP or ALL (if you are not sure, put ALL).

2. ASUS (RT-AX88U, RT-AC68U, etc.)

Log in to your Control Panel (router.asus.com) and follow the instructions:

1. Go to Internet → Port Forwarding.
2. Turn on call forwarding if it is disabled.
3. Add a rule:
   • Service name: arbitrary (for example, "Minecraft Server").
   • Port range: 25565 (or your port).
   • Local IP: device address.
   • Local port: usually coincides with the external one.
   • Protocol: TCP/UDP or select separately.

3. Keenetic (Giga, Hero, Lite, etc.)

Keenetic takes a slightly different approach with the concept of "firewall rules".

1. Go to the web configurator (192.168.1.1) and open Security → Firewall.
2. Click Add a rule and select Port forwarding (DNAT).
3. Fill in:
   • Interface: Provider (external network).
   • Protocol: TCP/UDP.
   • Port of destination: external port (eg 8080).
   • New destination address: local IP of the device.
   • New port of destination: internal port (usually the same).

For other routers (Zyxel, D-Link, MikroTik) the logic is similar: look for sections with names Port Forwarding, Virtual server or RedirectionIf you can't find it, check the manual for your model.

Alternative methods: UPnP and DMZ

If port forwarding isn't working or seems too complicated, consider alternative options. They aren't always secure, but they can sometimes save the day when standard methods fail.

1. UPnP (Universal Plug and Play)

UPnP allows devices on a local network automatically open ports Without manual configuration. This is convenient, but dangerous: any virus or vulnerable application can open the port without your knowledge.

How to enable:

• Find the section in your router UPnP (usually in Local area network or Internet).
• Activate the function and save the settings.
• On the target device (for example, in a torrent client), enable UPnP support.

⚠️ Attention: UPnP is often used by malware to bypass firewalls. If network security is critical (for example, in an office), it's best to disable UPnP and configure ports manually.

2. DMZ (Demilitarized Zone)

DMZ redirects all external ports to one device on the local network. This is a radical method that can help if forwarding fails, but it is extremely insecure: the device in the DMZ becomes completely vulnerable to attacks from the internet.

How to set up:

1. Find the section in your router DMZ (usually in Internet or Security).
2. Enable DMZ and specify the local IP of the device.
3. Save the settings and reboot the router.

⚠️ Attention: Never place devices containing important data (such as your primary PC or NAS) in the DMZ. Use this method only for testing or temporary tasks, and then disable it.

How to check if a port is open

You've set up forwarding—but how can you make sure it's working? There are several ways to check, from simple online services to the command line.

1. Online services

The fastest method is to use specialized sites:

• 🌐 PortChecker
• 🌐 YouGetSignal
• 🌐 CanYouSeeMe

Just enter the port number and click CheckIf the port is open, you will see a message like Success: I can see your service on [IP]:[PORT].

2. Command line (Windows/macOS/Linux)

To check from another network (for example, from a phone via mobile Internet), use the command telnet or nc:

telnet [your_external_IP] [port]

If the port is open, you'll see a blank screen or a service welcome message. If the connection is reset, the port is closed.

On Linux/macOS you can use netcat:

nc -zv [your_external_IP] [port]

3. Local verification

If you are testing the port on the same device where the service is running, use:

netstat -ano | findstr [port]

On Linux/macOS:

ss -tulnp | grep [port]

If the port is listening (LISTENING), but external checks show that it is closed - the problem is in the router or provider.

Common mistakes and their solutions

Even experienced users sometimes encounter problems with port forwarding. Here are the most common errors and how to fix them:

• 🔌 The port is open, but the connection cannot be established.:
  • Check that the service on the target device is running and listening on the correct port.
  • Make sure that external access is allowed in the service settings (for example, in qBittorrent turn on Incoming connections).
• 🔄 The forwarding rule is not saved:
  • Update your router firmware—older versions can have bugs with saving settings.
  • Try using a different browser (for example, Firefox instead of Chrome).
• 🌍 The external IP changes after rebooting the router.:
  • You have a dynamic IP. Order a static IP from your provider or use a service DDNS (For example, No-IP).
• 🛡️ The port is open, but access is blocked:
  • Check the firewall settings on the target device.
  • If you use Kaspersky or ESET, add an exception for the port.

If all else fails, try resetting your router to factory settings and reconfiguring forwarding. Sometimes corrupted configurations can prevent it from working properly.

Security: Which ports should you not open?

Opening ports is always a tradeoff between functionality and security. Some ports are favorite targets for hackers, and forwarding them unnecessarily can lead to your network being hacked.

List of dangerous ports (do not open without protection!):

• 🚨 21 (FTP) - vulnerable to login/password interception.
• 🚨 22 (SSH) - If a weak password is used, bots will guess it in hours.
• 🚨 23 (Telnet) - transmits data in clear text.
• 🚨 3389 (RDP) is a prime target for brute force attacks.
• 🚨 5900 (VNC) - remote access without encryption.

If you still need to open one of these ports, be sure to:

1. Use complex passwords (at least 12 characters with numbers and special characters).
2. Restrict IP access: in your router settings, specify which addresses are allowed to connect.
3. Set up VPN (For example, WireGuard) and open ports only inside the encrypted tunnel.

⚠️ Attention: If you open a port for Minecraft servers or another public service, expect your IP to soon be listed by vulnerability scanners. Use fail2ban or similar tools to block suspicious connections.

Opening port 3389 (RDP) without additional protection (VPN or IP restrictions) is almost guaranteed to result in hacking attempts within the first 24 hours. Hackers constantly scan the internet for open RDPs and try to guess passwords.

FAQ: Answers to frequently asked questions