Guides › Port forwarding
Port forwarding through a VPN: how it works and when you need it
A VPN hides you behind its server's address. That also means nothing on the internet can reach you unless the server is told to let it through. Port forwarding is that instruction.
Updated
Why a VPN blocks incoming connections
When you are connected, the rest of the internet sees the server's public address, not yours. Many customers share that address at once, so when a packet arrives at it addressed to, say, port 51413, the server has no idea which of those customers it is for and drops it. That is good for privacy and it is what most people want. It is also why anything that needs to accept connections, rather than make them, stops working behind a VPN.
What port forwarding changes
Port forwarding is a standing instruction to the server: packets arriving at this port are for this customer's tunnel. Reserve port 24312 and, while your device is connected, anyone on the internet who connects to the server's address on port 24312 reaches your device, for both TCP and UDP. Nothing else about the tunnel changes: outgoing traffic is still hidden behind the shared address, and the other ports stay closed.
What people use it for
- BitTorrent. Without a reachable port you can connect to peers but they cannot connect to you, which halves the swarm you can see and makes seeding to other NATed users impossible. A forwarded port makes you "connectable" and the client's speed and ratio usually improve noticeably.
- Game servers and voice. Hosting a Minecraft, Valheim or Mumble server from behind a VPN, or getting an "open NAT" type for peer-to-peer games.
- Self-hosting. Reaching a home server, a camera or a NAS through the VPN's address without exposing your own, and without your ISP's CGNAT getting in the way.
- Remote access. SSH to a machine that sits on a network you do not control.
How ours works
Go to Port forwarding in the dashboard and reserve a port. The panel offers a few free ones from the forwarding range as one-click picks, or you can ask for a specific number. From that moment the port is yours, on every server, until you release it:
- It follows you. Connect to Germany today and the United States tomorrow; the same port is open for you on whichever node you join. When your device connects, the node is handed your reservations and applies the firewall rules for that session, and removes them when the session ends.
- Remote port to local port. By default the remote port maps to the same number on your device. If your application listens elsewhere, set a different local port and the node translates.
- Test it. Each reserved port has a Test button that tries to reach it from outside while you are connected, so you know whether the problem is the forward or the application behind it.
- A cap per account, and one reservation per port network-wide; a port someone else holds is simply not offered.
The page is visible to every account, including free ones, so the feature is discoverable; reserving needs a plan that includes it. The Pricing page marks which do.
Setting up the application
- Reserve a port and note the number.
- Tell your application to listen on that port. In a torrent client this is "Listening port" or "Incoming port"; turn off UPnP and NAT-PMP, which cannot work through a VPN anyway.
- Connect the VPN. The forward is only active while a session is up.
- Press Test on the Port forwarding page, or use the client's own "port open" check.
What it does and does not expose
A forwarded port makes exactly one port on the server's address reachable, and whoever connects to it learns the server's address, which is public anyway. It does not reveal yours. What it does do is put whatever software is listening on that port on the open internet, so treat it the way you would treat opening a port on your home router: run only what you intend to expose, keep it updated, and release the port when you are finished. The Port forwarding page shows every reservation you hold so nothing stays open by accident.
Port forwarding works identically over OpenVPN and WireGuard. Think twice before combining it with Tor mode: the point of Tor mode is to be unreachable, and a forwarded port is a way in.
Questions
Do I need port forwarding for torrents?
Not to download. Without a forwarded port you can only connect to peers that accept incoming connections; with one, peers can also connect to you, which means more peers, faster starts, and the ability to seed to people who are themselves behind NAT.
Is the same port available on every server?
Yes. A port you reserve is yours on every server that supports forwarding. When your device connects, the node is handed your ports and opens them for that session.
Does port forwarding make me identifiable?
It makes one port on the server's address reachable, and whoever connects to it learns that address, not yours. Run only software you intend to expose on that port, keep it updated, and release the port when you no longer need it.
Which plans include it?
The plans marked with port forwarding on the Pricing page. Everyone can see the Port forwarding page in the dashboard; reserving a port needs a plan that includes it.
Try it
Every new account starts with a free trial, every plan includes every location, and you can pay by card, Bitcoin, Lightning or Monero.