Skip to content
FixMyNBN

Getting in from outside

Going out to the internet just works. Getting in to something at home (a game server, a camera recorder) is another matter, and it is where port forwarding and CGNAT come in. Follow one request, step by step, and watch what each router does to it.

How every device in your home gets online through one public address.

THE INTERNETYOUR HOMEA website198.51.100.10YOUR ROUTERout 203.0.113.7in 192.168.1.1Your phone192.168.1.23and every other device in the houseFROM192.168.1.23:51000TO198.51.100.10:443

A request goes out, and the answer finds its way back

Step 1 of 5

Your phone asks a website for a page. It puts its own address on the request so the answer can find its way back. That address only means something inside your home.

Your router's notebook

Who inside is talking to whom outside, so answers can be handed back.

  • Nothing written down yet.

Every address in the picture is a made-up example. A port is the number after the colon: it says which conversation, or which program, a message belongs to.

Do you need a port forward at all?

Usually not. A port forward only matters when something outside has to start the conversation.

You do not need one for

  • Browsing, streaming, email and video calls
  • Almost all online gaming: you connect out to the game
  • Doorbells, cameras and smart plugs that work through their maker's app

You may need one for

  • Running a game server that friends join from their own homes
  • Reaching your own camera recorder, storage box or home server directly from outside
  • A few games and consoles that connect players straight to each other (the "strict NAT" message)

UPnP: the router writes the note for you

With UPnP switched on, a console or game can ask the router to add its own port forward and remove it afterwards. It is the easy fix for a "strict NAT" message. The catch is that any program on your network can ask, so switch it off if nothing you own needs it.

A forwarded port is open to everyone

Not just your friend: anyone on the internet can knock on it, and automated scanners find open ports quickly. Forward only the port you need, to a device you keep updated, and remove the rule when you stop using it. Never forward a camera or storage box's sign-in page.

Is your address your own, or shared?

Compare two numbers. The first is the address the internet sees you coming from. The second is the "WAN" or "Internet" address shown in your router's own settings. If they are the same, the address is yours and a port forward can work. If they differ, something between your router and the internet is sharing it.

Check your public address

Two routers in your own home

The same thing happens on a small scale when your own router is plugged into another router, such as the one your provider supplied. Each keeps its own notebook, so a port forward on one of them is not enough. Put the first one into "bridge" mode so it stops acting as a router, or forward the port on both.

If your router's address starts with

  • 100.64 to 100.127Shared by your provider (CGNAT)
  • 192.168Private: a second router in your own home
  • 10Private: a second router, or your provider's network
  • 172.16 to 172.31Private: a second router, or your provider's network

Anything else is normally a public address.

If your address is shared

Providers share addresses because the old kind of internet address ran out years ago. Many NBN providers do it by default, and so, generally, do home 4G and 5G services and Starlink's standard plans. It costs you nothing until you want to connect in. Then there are four ways round it, best first.

  1. 1

    Ask your provider for your own public address

    This is the real fix. Many providers switch CGNAT off free when you ask (Aussie Broadband does), some charge a few dollars a month for a public or fixed address, and a few cannot do it at all. Telstra says it does not use CGNAT on home internet.

  2. 2

    Let the device call out instead

    Most cameras, doorbells and consoles do not wait to be called. They connect out to their maker's service, and your phone meets them there. That works through any number of routers.

  3. 3

    Use a link that dials out from home

    A remote-access app or tunnel (Tailscale and Cloudflare Tunnel are two) runs on a computer at home and connects outward, so nothing has to get in uninvited.

  4. 4

    Use IPv6, where it is offered

    The newer kind of address is not in short supply, so every device can have a public one of its own and nothing is shared. Your provider, your router and the app all have to support it.

Stuck with a "strict NAT" message or a port forward that will not work?The troubleshooter walks through it with you.