How to open ports on a Wi-Fi router: step-by-step instructions

Modern home networks are complex systems, where every connected device requires stable data exchange with the global network. However, default router security settings often block incoming connections, creating a so-called "wall" between your device and the internet. This phenomenon, known as NAT (Network Address Translation), protects the local network from external threats, but at the same time prevents the correct operation of online games, torrent clients, or remote servers.

To ensure unimpeded access to certain services, the user must perform a procedure called port forwarding. This process requires careful attention, as it involves changing critical network hardware parameters. It is important to understand that opening ports reduces the level of network perimeter security, so this should only be done for trusted applications.

In this article, we'll walk you through the steps to properly configure your router. We'll cover not only the technical steps for entering parameters, but also the theoretical aspects of network protocols, so you understand the changes taking place.

Theoretical Foundations: What are Ports and NAT?

Imagine your IP address is the address of an apartment building, and the ports are the specific apartments where mail should be sent. When you request a web page, your computer "tells" the router that it's expecting a response on a specific port, and the router remembers this request. However, if an external system attempts to contact you directly (for example, a game server for creating a room), the router doesn't know who in the "building" the data is addressed to and blocks it by default.

TCP and UDP protocols These are the primary transport mechanisms for data transfer. TCP guarantees packet delivery and order, which is critical for loading pages or files. UDP is faster but lacks guarantees, making it ideal for streaming video and online gaming, where speed is crucial and losing a few frames isn't a problem. When configuring a router, you often need to specify the protocol type for filtering rules to work correctly.

There is also a concept static IP address Within the local network. Since the router assigns addresses dynamically (via DHCP), the address of your computer or console may change after a reboot. If this happens, the configured forwarding rule will no longer work, as it will point to the old, no longer active device address.

⚠️ Attention: Opening ports makes your device visible to network scanners. Never forward ports for outdated or unverified programs that may contain vulnerabilities.

Preparing for Setup: Static IP and Addressing

The first and most important step before making changes to the routing table is to secure the IP address of the device being configured. As mentioned earlier, dynamically changing the address will cause the rule to fail. You need to reserve the address either in the computer's settings or, more accurately, in the router interface via the DHCP Reservation feature.

To get your current network settings in the Windows operating system, you can use the command line. This will allow you to find out your current gateway (router address) and your local IP. Enter the command ipconfig /all in the terminal and find the line "Default gateway" - this is the address we will use to access the admin panel.

Microsoft Windows [Version 10.0.19045.4780]
(c) Microsoft Corporation. All rights reserved.

C:\Users\User>ipconfig /all

Ethernet adapter Ethernet:

Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : Realtek PCIe GbE Family Controller
Physical Address. . . . . . . . . : 00-1A-2B-3C-4D-5E
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.1.45(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : October 25, 2026 10:00:00
Lease Expires. . . . . . . . . . : October 26, 2026 10:00:00
Default Gateway . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.1.1

After receiving the address (in the example above it is 192.168.1.45) you need to access the router's web interface. This is usually done by entering the gateway address in the browser's address bar, most often 192.168.0.1 or 192.168.1.1The default login and password are often located on a sticker on the bottom of the device unless you have changed them previously.

Step-by-step instructions for port forwarding

Interfaces of different router manufacturers (TP-Link, ASUS, Zyxel, Keenetic) may differ visually, but the logic remains the same for all models. You need to find the section responsible for virtual servers, port forwarding, or NAT. In English-language menus, this is often called Port Forwarding, Virtual Server or NAT/QoS.

When creating a new rule, you'll encounter fields that must be filled in manually. A key parameter is the port range: if an application requires port 25565, you specify it in both the internal and external fields. Some routers allow you to specify a range, for example, from 5000 to 5010, if the application uses multiple connections.

The table below lists standard ports for popular services that often require configuration:

After entering all parameters, be sure to click "Save" or "Apply." Some router models apply changes immediately, while others may require a device reboot. Check the rule's status in the list—it should be marked as "Enabled."

What to do if the rule is not saved?

Sometimes the router doesn't accept settings due to a conflict with another rule or firewall. Try changing the external port number to a non-standard one (for example, use 8080 instead of 80), as system ports may be reserved by the firmware.

Setting up popular router models

Let's look at the specifics of setting up devices from different vendors, as the menu layout can be confusing for inexperienced users. Each manufacturer has its own unique terminology and menu structure.

On devices TP-Link (especially in the blue interface), the required section is located in the "Forwarding" -> "Virtual Servers" menu. Here, click "Add New," select a service (or create your own), and enter the computer's IP address and port. It's important to select "All" or a specific protocol (TCP/UDP), depending on the program's requirements.

In routers ASUS With ASUSW Merlin or stock firmware, the section is called "WAN" -> "Virtual Server / Port Forwarding." The interface here is more intuitive: on the left, you select a device from the list of connected clients, and on the right, you drag the port sliders or enter them manually in the text fields.

Devices Keenetic (formerly Zyxel Keenetic) have a very flexible configuration system. Go to "Security" -> "Network Address Translation (NAT)." Create a new rule, selecting "Broadband connection (ISP)" in the "Interface" field, and entering your local IP address in the "Forward to address" field.

⚠️ Attention: Firmware interfaces are updated regularly. If you can't find the menu you're looking for, check the manufacturer's official website for a newer version, as the menu structure may have changed.

Diagnostics and checking of open ports

After completing all the steps, you need to ensure that the ports are truly open and accessible from the external network. A simple test within the local network won't provide a reliable result, as the router may be allowing requests from "internally." For testing, it's best to use a smartphone connected to mobile internet (3G/4G) or ask a friend to check for accessibility.

There are many online services for checking such as 2ip.ru, portchecker.co or yougetsignal.comEnter the port number you just opened and run the scan. If the service reports the port as "Open," the setup was successful.

However, if the check shows "Closed" or "Filtered," the problem may lie elsewhere. Often, the operating system's built-in firewall (Windows Defender Firewall or antivirus software) blocks incoming connections, even if the router allows them. In this case, you need to create an allow rule in the firewall settings on your computer.

Safety and alternative solutions

Opening ports is a tradeoff between functionality and security. You're literally creating a hole in your network's security wall. If an application using this port is vulnerable, attackers can gain access to your device. Therefore, always keep your software updated.

Modern technologies such as UPnP (Universal Plug and Play), allow applications to automatically open ports without user intervention. While this is convenient, it poses a security risk, as any program (including malware) can do this without your knowledge. It's recommended to keep UPnP disabled and manually configure ports only for trusted applications.

To provide remote access to files or your desktop, it is much safer to use a VPN server (for example, WireGuard or OpenVPN), built into modern routers. In this case, you don't need to open ports for specific services; you connect to your home network "from the inside," so to speak, and all resources are securely accessible.

Why is my port closed even though I have configured everything?

There are several possible causes: your ISP uses CGNAT technology (issuing a "gray" IP address), your antivirus is running on your PC, or you're checking the port while an application is running that blocks it. Also, check if you're using IPv6, as some testers only work with IPv4.

Is it dangerous to open port 80 or 443?

Yes, these are standard web server ports. Unless you need to host a public website from your home IP, it's best to avoid using them to avoid attracting the attention of automated botnet scanners.

Do I need to open ports to improve my internet speed?

No, port forwarding does not increase connection speed. It only allows external servers to initiate connections to you, which is critical for hosting games or servers, but does not affect the speed of file downloads or video playback.

Will the port settings be reset when I reboot the router?

No, if you click the "Save/Apply" button, the rule is written to the device's non-volatile memory and will remain after a reboot. Resetting the rule is only possible with a full reset of the router's settings (Reset to Factory Defaults).