What is VPN port forwarding?

VPN port forwarding is a powerful yet often misunderstood tool. It's commonly mistaken for traditional port forwarding, but the two are inherently different. VPN port forwarding enables specific types of network traffic to bypass the VPN tunnel and directly access a device or service on your local network, whether it's at home or in the office. It's especially helpful for applications that require direct incoming connections, such as:

• Hosting game servers
• Running web servers
• Remotely accessing security cameras or baby monitors when you’re not at home
• Engaging in peer-to-peer (P2P) file-sharing
• Bypassing firewalls or restrictions blocking access to specific websites or services

However, it's important to be cautious. When you use VPN port forwarding, you're essentially opening your devices to the open internet, which can pose security risks. 

In this guide, we delve deeper into the differences between traditional port forwarding and VPN port forwarding, as well as show you how you can securely set up port forwarding on your router, allowing you to maximize its benefits without compromising your network's safety.

Jump to...
Port forwarding vs. VPN port forwarding
3 types of port forwarding
Automatic port forwarding: What’s UPnP?
Port forwarding vs. port triggering
Advantages of VPN port forwarding
Disadvantages of VPN port forwarding
How to set up port forwarding on your router
How to set up VPN port forwarding on your router

Port forwarding vs. VPN port forwarding

Port forwarding and VPN port forwarding are two distinct methods. Although the terms are often used interchangeably and are related, here's how they differ:

How does port forwarding work?

Device on the internet 🌐 → Router 🏠 → Device on the internal network 🖥️

Port forwarding is a technique that directs incoming traffic from specific ports on your router to a particular device within your network. This is useful for hosting servers or other applications that need to be accessible from the internet. 

For example: You have a home server that you want to be accessible from the internet. You would forward the ports that your server uses to your router. This would allow anyone on the internet to access your server by connecting to your public IP address on those ports.

Here is a simplified explanation of exactly how port forwarding works:

1. A device on the internet sends a request to a port on the router's public IP address.
2. The router checks its NAT table (a table that maps private IP addresses to public IP addresses) to see if there is a port forwarding rule for the requested port.
3. If there is, the router forwards the request to the internal IP address and port specified in the rule.
4. The device on the internal network receives the request and responds.
5. The router forwards the response back to the device on the internet.

How does VPN port forwarding work?

Device on the internet 🌐 → VPN server 🔐 → Router 🏠 → Device on the internal network 🖥️

VPN port forwarding is a similar technique, but it’s used to forward incoming traffic on specific ports to a device on a remote network through a VPN connection. This can be useful for accessing devices on a home network while you’re away, or for hosting servers on a remote network.

For example: You’re traveling for work and you need to access your home server. You would connect to your home VPN server. Once you’re connected, you would forward the ports that your server uses to the VPN client. This would allow you to access your server by connecting to the local IP address that the VPN client assigns to it.

Here is a quick overview of how VPN port forwarding works:

1. A device on the internet sends a request to a port on the VPN server's public IP address.
2. The VPN server checks its port forwarding table to see if there is a rule for the requested port.
3. If there is, the VPN server forwards the request to the internal IP address and port specified in the rule.
4. The device on the internal network receives the request and responds.
5. The VPN server forwards the response back to the device on the internet.

Read more: How to set up a VPN on your router

Port forwarding vs. VPN port forwarding: What’s the difference?

The main difference between port forwarding and VPN port forwarding is that port forwarding is done at the router level, while VPN port forwarding is done at the VPN client level. This means that port forwarding will apply to all devices on the local network, while VPN port forwarding will only apply to the device (usually your router) that’s connected to the VPN.

Another difference is that port forwarding typically requires you to have a static public IP address from your ISP. This is because the router needs to know where to forward the incoming traffic. VPN port forwarding does not require a static public IP address, because the VPN server will assign a private IP address to the VPN client.

Here’s a quick summary of the key differences between port forwarding and VPN port forwarding:

It's important to note that not all VPN services support port forwarding. In fact, ExpressVPN is one of the few high-quality VPN providers that offers router-based port forwarding. This means that you can use ExpressVPN to access your local network devices and services from anywhere in the world.

3 types of port forwarding

Port forwarding can be a helpful tool when networking. There are three types tailored for specific situations, and knowing them can help optimize network setups. 

Here are the different types of port forwarding that also apply to VPN port forwarding:

1. Local port forwarding

Great for: Remote work, sharing files or services with others, bypassing censorship

Local port forwarding is the most common form of port forwarding. It involves directing traffic from a specific port on your router's public IP address to a designated port on a device within your internal network. This is particularly useful for hosting services on your home network, such as a web server or game server.

When applied to VPNs, local port forwarding allows you to host services on your home network and make them accessible to the public through the VPN. For example, you can forward port 443 (the standard port for secure HTTP traffic, known as HTTPS) from your router to the computer running the web server on your network. This means that users connected to the VPN can access the web server securely as if they were on your local network.

2. Remote port forwarding

Great for: Bypassing censorship, unblocking content, secure remote access

Remote port forwarding operates similarly to local port forwarding, but it directs traffic from a specific port on your router's public IP address to a designated port on a device within a different network. This is beneficial for gaining access to services on a remote network, such as a work network or a friend's home network.

For example, you could forward a range of ports on your router to a corresponding range on a file server at your workplace. This allows you to access files and services on your work network securely through the VPN, regardless of your physical location.

3. Dynamic port forwarding

Great for: Sharing files with others, playing multiplayer games, making VoIP calls

Dynamic port forwarding is a more complex form of port forwarding that allows you to direct traffic from a range of ports on your router's public IP address to a corresponding range on a device within your internal network. This is particularly useful for applications that require multiple open ports, such as P2P file-sharing applications.

For example, you might use dynamic port forwarding to enable a P2P file-sharing application on your home network. By forwarding a range of ports from your router to the computer running the file-sharing application on your network, you can securely share files with other users connected to the VPN.

Automatic port forwarding: What’s UPnP?

As we delve into VPN port forwarding, it's important to also consider Universal Plug and Play (UPnP). This widely used set of protocols allows devices to easily communicate and work together on a network without manual configuration.

UPnP essentially lets devices on the same network discover each other, share information, and open ports automatically. This can be useful in home and small office settings, but wouldn’t make sense in an office environment since a large number of devices would be taking up a lot of traffic. It’s also worth noting that while UPnP is convenient, it’s considered a lot less safe than traditional port forwarding.

This is because UPnP allows devices to open ports without explicit user consent or oversight. This means that if a malicious program or device gains access to the network, it could potentially exploit UPnP to open ports and expose the network to unauthorized access or attacks from the internet. Learn more about UPnP and why it’s considered unsafe.

Fortunately, UPnP isn’t the only way to facilitate automatic VPN port forwarding. Another option is port triggering, which provides a more secure alternative, albeit with some limitations.

Port forwarding vs. port triggering

Port triggering is more secure than UPnP because it only opens ports when a specific device on your network requests them. This is done by configuring a trigger port, which is a port that the device will use to initiate outgoing traffic. When the device sends traffic out on the trigger port, the router opens the incoming ports that the device needs. The ports remain open for a specified amount of time, or until the device stops sending traffic.

Port triggering is, therefore, a good option for applications where outgoing traffic is initiated from the device inside the network, such as gaming consoles and P2P file-sharing applications. This is because port triggering aligns with the natural flow of communication in these scenarios. 

However, it is not a good option for applications where incoming traffic is initiated from the device outside the network, such as webcams and remote desktop applications. These applications require a steady and direct connection for external access. If you want to set up automatic port forwarding for these, UPnP may be a more suitable choice.

Note: Assess UPnP, port forwarding, or port triggering and decide on your comfort level with the security risks before using them.

Advantages of VPN port forwarding 

While both port forwarding and VPN port forwarding have their advantages, VPN port forwarding offers greater benefits. It provides extra security and flexibility, making it a more powerful way to manage network traffic. 

Disadvantages of VPN port forwarding

Despite their respective advantages, both port forwarding and VPN port forwarding come with their own set of drawbacks. The most significant concern centers around security risks. 

Setting up port forwarding incorrectly can potentially expose your network to unauthorized access, making you more susceptible to hackers. With VPN port forwarding, there's the added consideration of bypassing some of the VPN's encryption, which can introduce an additional security risk. 

Considering the potential security risks involved, you're probably wondering if you should use port forwarding or VPN port forwarding. There's nothing inherently wrong with utilizing these features, provided you approach them with caution and ensure proper configuration on your router or VPN server. 

How to set up port forwarding on your router 

The exact steps of setting up port forwarding may vary depending on your router's brand and mode, so here's a general overview:

1. Log in to your router's web interface: This is usually done by typing your router's IP address into a web browser: You can find your router's IP address by following these steps.
2. Find the port forwarding section: This is usually located under a tab called “Port Forwarding”, “Port Triggering”, “Virtual Servers”, or “Applications”. It’s usually in the router’s settings.
3. Add a new port forwarding rule: This is like giving directions to your router. You'll need to tell it:

• • Service name: This is a name for the port forwarding rule. Give it a name such as “Web Server” or “Gaming”.
  • Port number(s): This is the port number(s) that you want to forward (i.e. a specific address for the traffic). You can find the port numbers that you need to forward for specific applications or games by searching online. Alternatively, here’s a list of some of the common port numbers for Windows. If you’re a Mac user, you can also check Apple’s list of common ports.
  • Protocol: This is the type of traffic that you want to forward, such as TCP or UDP.
  • Internal IP address: This is the IP address of the device on your network that you want to forward the ports to. You can find the IP address of your device by running the ipconfig command in a command prompt window.

4. Save your changes: After filling in the details, save your changes. Your router will now know where to send specific types of traffic.

How to set up VPN port forwarding on your router 

A more convenient method for opening ports on your router is through a VPN that supports port forwarding, like ExpressVPN. This is a simpler approach than manually configuring the router, especially when dealing with numerous ports for various games. It not only helps bypass NAT firewalls but also encrypts your internet connection.

You can choose to connect to the VPN either before or after applying port forwarding rules on your router. The objective is to protect your direct communication line from unverified requests and potential DDoS attacks.

If you're using a router with ExpressVPN, here's how to set up port forwarding:

1. Sign in to your router with ExpressVPN installed.
2. Go to Advanced Settings > Port Forwarding.
3. Click on Add New Rule.

4. Provide the following details:

1. • Description: Give it a name for easy recognition.
   • Device: Choose the device you want to access remotely.
   • Internal Port: Specify a number between 1 and 65,535.
   • External Port: Specify a number between 1 and 65,535.
   • Protocol: Select your preferred protocol.

5. Click Save to add the new rule.

Your chosen device should now be accessible remotely using your public IP address and the external port you specified. To verify if port forwarding is successful, you can use ExpressVPN’s IP Address Checker to find your device’s public IP.