--- title: "What is NAT and port forwarding: self-hosting at home and why it fails | StreetHosting" description: "Learn what NAT, private and public IPs and router port forwarding are, why CGNAT blocks self-hosting at home, and when a public IPv4 VPS fits better." url: "https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding" type: "page" language: "en-US" --- Infrastructure · 8 min · Intermediate Published on Nov 13, 2026 · Updated on Nov 13, 2026 # NAT and port forwarding: how they work and why ports will not open behind CGNAT Every device in your home reaches the internet with the same public IP, thanks to NAT. For someone outside to reach one of them, you have to forward a port on the router, and that only works if your router's IP is really public. By [Equipe StreetHosting](https://streethosting.com.br/en/autores#equipe-streethosting) · StreetHosting infrastructure and support team [Security and hardening](https://streethosting.com.br/en/guides/topics/security) [Network, DNS and domains](https://streethosting.com.br/en/guides/topics/networking) Summarize with: [](https://chat.openai.com/?q=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Finfrastructure%2Fwhat-is-nat-port-forwarding.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "ChatGPT") [](https://claude.ai/new?q=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Finfrastructure%2Fwhat-is-nat-port-forwarding.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "Claude") [](https://www.google.com/search?udm=50&aep=11&q=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Finfrastructure%2Fwhat-is-nat-port-forwarding.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "Google AI Mode") [](https://x.com/i/grok?text=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Finfrastructure%2Fwhat-is-nat-port-forwarding.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "Grok") [](https://www.perplexity.ai/search/new?q=Summarize%20the%20key%20points%20of%20this%20StreetHosting%20guide%3A%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Finfrastructure%2Fwhat-is-nat-port-forwarding.%20Highlight%20the%20step-by-step%20instructions%2C%20the%20prerequisites%20and%20the%20most%20common%20mistakes. "Perplexity") Share: [](https://x.com/intent/tweet?text=What%20is%20NAT%20and%20port%20forwarding%3A%20self-hosting%20at%20home%20and%20why%20it%20fails&url=https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Finfrastructure%2Fwhat-is-nat-port-forwarding "Share on X") [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Finfrastructure%2Fwhat-is-nat-port-forwarding "Share on Facebook") [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Finfrastructure%2Fwhat-is-nat-port-forwarding "Share on LinkedIn") [](https://wa.me/?text=What%20is%20NAT%20and%20port%20forwarding%3A%20self-hosting%20at%20home%20and%20why%20it%20fails%20https%3A%2F%2Fstreethosting.com.br%2Fen%2Fguides%2Finfrastructure%2Fwhat-is-nat-port-forwarding "Share on WhatsApp") For agents: Copy as Markdown [.md](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding.md) In this guide 6 sections * [Private IP and public IP](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#ip-privado-publico) * [How NAT works](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#como-nat-funciona) * [Forward a port on the router](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#redirecionar-porta) * [Why it does not work behind CGNAT](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#por-que-falha) * [UPnP and its risks](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#upnp) * [The VPS as an alternative](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#onde-rodar) Quick answer **NAT** (Network Address Translation) is the translation a router does so that every device in your home, each with a private IP, reaches the internet through a single public IP. Someone outside cannot start a connection to an internal device unless you create a **port forwarding**rule, which sends a router port to an internal IP and port. That only works if the router's WAN IP is public. Behind CGNAT, the ISP shares one public IP among many customers and no rule on your router fixes it. ## Private IP and public IP[](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#ip-privado-publico) A public IP is an address routable across the whole internet: any machine in the world can send a packet to it. A private IP only makes sense inside a local network. There are ranges reserved for that, never announced on the internet, which is why they can repeat in millions of homes at the same time: | Range | Number of addresses | Where it usually shows up | | ------------------------------ | ------------------- | ------------------------------------------------- | | 10.0.0.0 to 10.255.255.255 | About 16.7 million | Company and ISP networks | | 172.16.0.0 to 172.31.255.255 | About 1 million | Docker and internal networks | | 192.168.0.0 to 192.168.255.255 | 65,536 | Home routers, such as 192.168.0.1 and 192.168.1.1 | | 100.64.0.0 to 100.127.255.255 | About 4 million | ISP CGNAT range | When you open your phone on the home wireless network, it gets something like `192.168.0.25`. That number only holds inside your network. To the internet, every device in the house appears with the router's public IP. Since the private range repeats everywhere, it is impossible for someone outside to address one of your devices by its private IP: the packet does not know which home you mean. A server in a datacenter works differently. The machine gets its own public IPv4, with no home router in the middle, and is reachable directly. The difference between the address formats is covered in [IPv4 and IPv6 on servers](https://streethosting.com.br/en/guides/infrastructure/ipv4-vs-ipv6-game-server). ## How NAT works[](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#como-nat-funciona) The type of NAT used at home swaps the IP and also the source port. That is why it is also called NAPT or PAT. The path of an outgoing connection is this: 1. Your computer (192.168.0.25) opens a connection to a website, using any source port, say 51000. 2. The router replaces the source address with its own public IP, picks a port of its own, like 40001, and writes it in a table: port 40001 belongs to computer 192.168.0.25, port 51000. 3. The website replies to the router's public IP, on port 40001. 4. The router checks the table, finds the owner of that connection, undoes the swap and hands the packet to the computer. The detail that matters: the table entry is born when the device inside starts the conversation. A packet that arrives from outside without anyone having asked for it finds no row, and the router drops it. That is exactly why NAT works as an accidental protection, and also why it stops you from hosting something. Without a row in the table, the router does not know which device to deliver a visit arriving on port 80, for example. NAT is not a real firewall. It hides devices as a side effect, but it does not inspect content or apply rules. If you forward a port, the service behind it is as exposed as on any public server. ## Forward a port on the router[](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#redirecionar-porta) Port forwarding is the manual rule that creates the table row before anyone asks: everything that arrives at the public IP on port X goes to device Y on port Z. The names change from router to router. Look for Port Forwarding, Virtual Servers or NAT, usually in the advanced network menu. 1. **Pin the device's IP.**On the router's DHCP page, make an address reservation for the computer that will receive the connections. If the internal IP changes after a reboot, the rule ends up pointing to the wrong device. 2. **Create the rule.**Enter the external port (the one the world will use), the device's internal IP, the internal port (the one the program listens on) and the protocol, TCP, UDP or both. Usually the two ports are the same. 3. **Confirm the program listens on the port.** On Linux, the `ss -tlnp` command lists the TCP ports in listening state. On Windows, use `netstat -ano | findstr :8080`. 4. **Allow it in the device's firewall.** The Windows firewall or Linux UFW must also accept the port, otherwise the packet reaches the machine and is dropped there. 5. **Test from outside your network.**Turn off your phone's wifi and connect over 4G or 5G, or ask a friend. Testing from inside the house misleads: many routers cannot send back inside a packet that went out to the public IP (called NAT loopback), and the port looks closed even when it is right. Two commands help check the result. The first shows the public IP the internet sees, and the second tests a TCP port from a machine outside your network, such as a VPS: `# public IP as seen by the internet (Linux, macOS or Windows 10 and 11; # in PowerShell, type curl.exe instead of curl) curl -4 ifconfig.me # from a machine outside your network, tests port 8080 on your public IP nc -vz SEU_IP_PUBLICO 8080` If you prefer a simpler test, the guide on [how to check whether a port is open](https://streethosting.com.br/en/guides/infrastructure/check-open-port-server) shows the ways to test and how to read each answer, closed, filtered or open. Another common problem is the dynamic public IP. Most residential plans change the IP from time to time, and the address you gave your friends stops working. A dynamic DNS service updates a name with the current IP, but it still requires the IP to be truly public, and that is where the next section comes in. ## Why it does not work behind CGNAT[](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#por-que-falha) Some ISPs, to save IPv4 addresses, put several customers behind a single public IP. That is CGNAT (Carrier Grade NAT): your router does one NAT, and the ISP does another on top. The second NAT's table belongs to the ISP, not to you. No rule created on your router reaches that table, so the port never opens, no matter how many times you check the configuration. The test takes a minute. On the router's status page, look at the WAN IP and compare it with what `curl -4 ifconfig.me` shows: * **Both are the same:** the router has a public IP. If the port does not open, the problem is in the rule, the firewall or the program. * **They differ:** there is a NAT in front of your router, and the WAN IP usually falls in 100.64.0.0 to 100.127.255.255 or in another private range. That is CGNAT, or a second router of your own in cascade. Before blaming the ISP, rule out double NAT inside the house. If the ISP modem and your wireless router both do NAT at the same time, you have to create the forwarding on both, or put the modem in bridge mode. The full diagnosis, with the ways out that work (using IPv6 or a tunnel to a VPS), is in [what CGNAT is and why it blocks your server](https://streethosting.com.br/en/guides/infrastructure/what-is-cgnat). ## UPnP and its risks[](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#upnp) UPnP (Universal Plug and Play) is a protocol that lets programs on the network ask the router, by themselves, to open ports. Games, consoles and torrent clients use it to work without the user touching anything. It is convenient, but it has a price: * **Any program on the network can open a port.** An infected or badly written app exposes a service to the internet without you being told. * **There is no authentication.** The request comes from inside the network, and the router trusts whoever asked. * **Historical flaws.** The UPnP implementation of many routers has had serious vulnerabilities, some of them allowing ports to be opened from the internet itself. If you host something at home and know which ports you need, turn UPnP off and use manual forwarding only. With it on, open the router's mapping list once in a while and remove what you do not recognize. Never leave the router's admin interface reachable from the internet. ## The VPS as an alternative[](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#onde-rodar) Hosting at home means taking care of everything along the way: dynamic IP, CGNAT, router, power and the upload bandwidth of a residential plan, which is usually much lower than the download. A VPS removes that layer. There is no home router or NAT for you to configure: the machine has a dedicated public IPv4, and opening a port is just allowing it in the system firewall, as shown in the guide on the [UFW firewall on a VPS](https://streethosting.com.br/en/guides/vps/ufw-firewall-ubuntu-vps). * **A truly public service:** a site, API, bot, panel or anything other people need to reach all day runs better on a [StreetHosting VPS](https://streethosting.com.br/en/vps). All of them are in São Paulo, use KVM with root access, include AntiDDoS and a dedicated IPv4, and activate in about 60 seconds after an approved Pix or card payment. The Xeon VPS starts at R$ 26.00 per month, with 2 vCPU, 2 GB DDR4 and 20 GB NVMe. * **A service that has to stay at home:** if the server must stay at home, for example a home automation device, the way is a WireGuard tunnel between it and the VPS. The VPS receives the connections from outside and forwards them through the tunnel, and CGNAT stops mattering. The VPN walkthrough is in [a WireGuard VPN on your VPS](https://streethosting.com.br/en/guides/vps/wireguard-vpn-vps). Each VPS has up to 5 TB of traffic per month, which is plenty for most personal services and small communities. In this guide * [Private IP and public IP](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#ip-privado-publico) * [How NAT works](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#como-nat-funciona) * [Forward a port on the router](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#redirecionar-porta) * [Why it does not work behind CGNAT](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#por-que-falha) * [UPnP and its risks](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#upnp) * [The VPS as an alternative](https://streethosting.com.br/en/guides/infrastructure/what-is-nat-port-forwarding#onde-rodar) ## Frequently asked questions What is NAT in one sentence? It is the address translation a router does so that several devices with private IPs share a single public IP. It swaps the source address of every outgoing packet and remembers who asked for what, so it can hand the reply back to the right device. Why is the port still closed from outside after I opened it on the router? There are three common causes. Your ISP uses CGNAT and the router's IP is not public. The program is not listening on the port or the computer's firewall blocks it. Or the forwarding rule points to an internal IP that changed. Test from outside your network, never from inside. How do I know if I am behind CGNAT? Compare the IP shown as WAN on the router page with the IP a site like ifconfig.me shows. If they differ, or if the WAN IP starts with 100.64 up to 100.127, or with 10, 172.16 to 172.31 or 192.168, there is CGNAT or another NAT in front of your router. Is UPnP safe? On an ordinary home network it is convenient, but it lets any program on the network open ports without asking for confirmation. An infected app can expose a service without you knowing. If you know which ports you need, prefer manual forwarding and turn UPnP off. Do I need port forwarding with IPv6? Usually not. On IPv6 each device normally has its own public address, with no NAT. What controls access from outside becomes the router's firewall, which has to allow the port to the device's address. Temporary privacy addresses change often, so allow the device's stable address, and keep in mind that some ISPs also change the prefix from time to time. Next step See VPS plans Root VPS in Brazil with NVMe and Anti-DDoS. [See VPS plans](https://streethosting.com.br/en/vps) ## Related guides [Infrastructure Intermediate What is CGNAT and why it blocks your server With CGNAT, your ISP shares a single public IP among several customers and no connection from the outside ever reaches your home. Here is how to confirm whether that is your case and which workarounds actually work for hosting a server. 11 min Read guide](https://streethosting.com.br/en/guides/infrastructure/what-is-cgnat) [Infrastructure Intermediate IPv4 vs IPv6: what changes for game servers An IP is your server's address on the internet. IPv4 is running out and IPv6 is the future, but compatibility still rules. Here is what that means for a game server. 3 min Read guide](https://streethosting.com.br/en/guides/infrastructure/ipv4-vs-ipv6-game-server) [Infrastructure Beginner How to check if a port is open on your server When a service is running but nobody can connect, the cause is almost always one of three things: the program does not listen where it should, a firewall blocks the packet, or the network along the way drops the connection. Here is how to tell them apart. 8 min Read guide](https://streethosting.com.br/en/guides/infrastructure/check-open-port-server) [← Back to the Guide Center](https://streethosting.com.br/en/guides)