Port forwarding, and why it sometimes cannot work
Most guides assume the rule will work once you get it right. For a lot of home connections it cannot, and no amount of fiddling will change that.
Every guide to hosting a game server has the same shape. Find your local address. Open your router’s admin page. Create a forwarding rule for the port. Tell your friends the address.
For most people that works. For a substantial minority it cannot work at all, and the guides do not mention it, so those people spend an evening convinced they have mistyped something.
What forwarding actually does
One public address arrives at your house, and several machines sit behind it. When a connection comes in on port 25565, the router has no way to know which machine it is for. A forwarding rule tells it: send anything on this port to this internal address.
That is the whole mechanism, and it has one requirement that the guides skip. Your router has to have the public address.
Carrier grade NAT
On a growing number of connections, it does not.
There are not enough IPv4 addresses. One response is for an ISP to do to its customers what your router does to your devices: put many households behind one public address, and keep a private address on your router’s WAN side. This is carrier grade NAT, and it is the default on most mobile broadband and on a lot of fibre.
If you are behind it, there is no rule you can write that will work, because your router is not what the internet is talking to. The port it forwards is a port on a network segment nobody outside can reach.
Telling in thirty seconds
Open your router’s status page and find its WAN or internet address. Then look at what the internet sees.
If they match, you have a public address and forwarding will work once the rule is right.
If they differ, you are behind CGNAT. The giveaway is a WAN address in 100.64.x.x through 100.127.x.x, which is the range reserved for exactly this, though 10.x.x.x shows up too.
That page will also test a port from outside your network, which is the other thing you cannot do from your own machine. Connecting to your own server proves nothing, because the connection never leaves the building.
If you do have a public address
Then it is the ordinary list, in the order it usually goes wrong.
The rule points at an internal address that has since changed. Reserve the address in the router’s DHCP settings, or the rule will quietly stop working the next time the machine reconnects.
The firewall on the machine is refusing the connection. Windows asks once, when the server first starts, and the prompt is easy to dismiss. The rule it creates is also per-network, so a laptop that moves around can lose it.
The rule is on the wrong protocol. Minecraft Java is TCP, most survival games are UDP, and a few want both. Valheim is 2456 UDP. Palworld is 8211 UDP. 7 Days to Die wants 26900 on both.
If you do not
Your options are asking your ISP for a public address, which some will sell and some will not, or not needing one.
ServerSync takes the second route. The server runs on your own machine and the connection is relayed through a public endpoint, so there is nothing to forward and nothing for the ISP’s NAT to interfere with. Your friends get an address that works, the world stays on hardware you own, and you never open the router’s admin page.
It is worth knowing which situation you are in before spending the evening. Thirty seconds of comparing two numbers will tell you.
ServerSync runs the server for you, on a PC you already own.
