VPN port forwarding is a feature that lets connections from the internet reach a device that sits behind a VPN. Normally a VPN only lets traffic out. Anything that tries to connect in, such as another torrent peer, a friend joining your game server or your phone opening your home media server, gets blocked at the VPN server. Port forwarding opens one specific door on that server and passes whatever knocks on it straight through the encrypted tunnel to your computer.
Most people never need it. If you use a VPN for streaming, browsing, public WiFi or online gaming on official servers, port forwarding adds nothing. It matters for a smaller group: torrent users who want more peers, people hosting game servers or self hosted apps, and anyone stuck behind CGNAT who cannot open ports on their own router. This guide explains how it works, when you need it, the security trade offs, which providers still offer it in 2026 and what to use instead.
Quick answer: do you need VPN port forwarding?
- You probably need it if you seed torrents and want to be "connectable", host a game or Minecraft server for friends, or run a home server that must accept outside connections while the VPN is on
- You probably need it if your internet provider uses CGNAT and you cannot get a public IP address
- You do not need it for Netflix and other streaming, browsing, banking, public WiFi protection or most online games
- You may want an alternative such as a mesh VPN if you only want to reach your own devices remotely
If you do need it, Proton VPN includes port forwarding on every paid plan, Private Internet Access includes it on most servers, Windscribe includes temporary ports on its Pro plan, and PureVPN sells it as a paid add on. NordVPN, Surfshark and ExpressVPN do not offer it.
What is a port, and what is port forwarding?
Every device on the internet has an IP address, which works like a street address. A port is a numbered door at that address, from 1 to 65535, and each app listens behind its own door. Web servers use port 443, Jellyfin uses port 8096, a Minecraft Java server uses 25565, and torrent clients pick their own listening port.
At home, your router hides every device behind a single public IP using NAT (network address translation). When your laptop asks for a web page, the router remembers the request and sends the reply back to the right device. When a stranger connects to your public IP without being asked, the router has no idea which device should get it, so it drops the connection. That is good for security, but it breaks anything that needs to accept incoming connections.
Port forwarding is a rule that fixes this: "anything arriving on port 25565, send it to the PC at 192.168.1.20." You can set it up on your own router, or your router can do it automatically through UPnP. The Wikipedia entry on port forwarding covers the networking background in more detail.
How VPN port forwarding works
When you connect to a VPN, your traffic leaves the internet from the VPN server's IP address, not your home IP. That server is shared by many customers and acts like a giant router with its own NAT. Even if you forward a port on your home router, outside connections never reach it, because the world only sees the VPN's IP.
VPN port forwarding moves the rule to the place where it matters. The provider reserves a port on the VPN server for your session and forwards it through your tunnel:
- You connect to a server that supports port forwarding, often labelled P2P
- The VPN app (or a protocol such as NAT PMP) asks the server for a port
- The server assigns a port number, for example 51413, and shows it in the app
- You enter that number as the listening port in your torrent client, game server or app
- Anyone connecting to the VPN server's IP on that port reaches your device through the encrypted tunnel
With most providers you cannot choose the port. It is assigned at random and may change every time you reconnect, so apps that need a fixed port need an extra step. Proton VPN, for example, documents the NAT PMP method on its official port forwarding support page, including scripts that update the port automatically.
Router port forwarding vs VPN port forwarding vs alternatives
| Method | Where the port opens | Works behind CGNAT | Hides your home IP | Best for |
|---|---|---|---|---|
| Router port forwarding | Your home router | No | No | Servers on a normal connection without a VPN |
| UPnP | Your router, opened automatically by apps | No | No | Consoles and casual use, with security risks |
| VPN port forwarding | The VPN server | Yes | Yes | Torrents, game hosting and servers behind a VPN |
| Mesh VPN | No public port at all | Yes | Yes | Reaching your own devices remotely |
| Reverse tunnel | A cloud relay such as Cloudflare Tunnel | Yes | Yes | Public websites and web apps |
What is CGNAT, and why does it make port forwarding matter?
CGNAT (carrier grade NAT) is the main reason more people now look for VPN port forwarding. IPv4 addresses ran out years ago, so many internet providers, especially mobile, fibre and satellite networks, now put whole neighbourhoods behind one shared public IP. The IETF reserved a special address range for this setup, 100.64.0.0/10, in RFC 6598.
Behind CGNAT you are behind two layers of NAT: your own router and your provider's. You can forward ports on your router all day and nothing will happen, because the provider's equipment drops incoming connections before they reach you. A quick test: if the WAN IP in your router settings starts with 100.64 to 100.127, or does not match the IP shown on a "what is my IP" site, you are almost certainly behind CGNAT.
A VPN with port forwarding gets around this neatly. Your tunnel is an outgoing connection, which CGNAT allows, and the public port lives on the VPN server, outside your provider's network. This is why self hosters on CGNAT connections often choose a VPN for their media servers; our guide to the best VPN for Jellyfin walks through that exact setup.
When you need VPN port forwarding
Torrenting and P2P
This is the most common reason. Torrent clients connect to other peers, and peers also try to connect to you. Without an open port you are "not connectable": you can still download, but only from peers who are connectable themselves. Two users who both lack open ports cannot talk to each other at all.
With a forwarded port you can connect to far more peers, which usually means faster downloads on rare or poorly seeded files and much better upload ratios on private trackers that reward seeding. On popular, well seeded torrents the difference is often small. Only share files you have the rights to share; a VPN does not change copyright law.
Hosting game servers
If you run a Minecraft, Valheim, Palworld or Terraria server on your own PC with a VPN on, friends cannot join without an open port. VPN port forwarding lets them connect to the VPN server's IP and the assigned port, without ever seeing your home IP. Because the port is usually random, you need to set the game server to listen on that number and give it to your friends each session.
Playing online is different. Big shooters such as Battlefield 6 and Warzone run on official dedicated servers, so port forwarding does not improve matchmaking or ping. Our guides to the best VPN for Warzone and the best VPN for Battlefield 6 explain what actually helps there.
Home servers and remote access
Media servers, NAS boxes, home automation dashboards and personal cloud apps all need inbound connections to be useful away from home. If the server runs behind a VPN, or your connection uses CGNAT, VPN port forwarding is one way to reach it. A mesh VPN is often a cleaner choice for personal access, as covered below.
Console NAT type
Xbox and PlayStation report a NAT type (Open, Moderate or Strict on Xbox; Type 1, 2 or 3 on PlayStation). Strict NAT can block voice chat and some party features. VPN port forwarding rarely fixes this, because consoles cannot run VPN apps and router VPN setups usually make NAT stricter. Fixing NAT on your router, through UPnP or manual rules, is normally the better path.
Do you need port forwarding? Use case table
| What you do | Need VPN port forwarding? | Why |
|---|---|---|
| Streaming Netflix, BBC iPlayer or HBO Max | No | All traffic is outgoing |
| Browsing, banking, public WiFi | No | Nothing needs to connect in |
| Online gaming on official servers | No | Dedicated servers handle connections |
| Downloading torrents | Helpful | More peers, faster on rare files |
| Seeding on private trackers | Yes | Being connectable is key for ratio |
| Hosting a game server behind a VPN | Yes | Friends must connect to you |
| Remote access to a home server on CGNAT | Yes, or a mesh VPN | Router forwarding cannot work |
| Video calls and messaging | No | Apps use relays and NAT traversal |
Is VPN port forwarding safe?
Port forwarding is not dangerous by itself, but it does widen your attack surface. A closed port is invisible; an open one invites anyone on the internet to try it. The good news is that VPN port forwarding is safer than opening ports on your router, because attackers only see the VPN server's IP, not your home address. The risks to understand are:
- Exposed apps: whatever listens on the forwarded port is reachable by the whole internet, so an outdated server, weak password or unpatched app can be attacked directly
- Firewall rules: the forwarded traffic arrives through the tunnel, so make sure your device firewall only allows the one app you intend to expose
- IP leak attacks: in 2015, researchers at Perfect Privacy described the Port Fail flaw, where a user on the same VPN server could use a forwarded port to reveal another customer's real IP; reputable providers patched it, but it shows why careful server design matters
- Server abuse: criminals also use forwarded ports, which gets VPN IPs blacklisted and is the main reason some providers dropped the feature
Mullvad, a highly respected privacy VPN, removed port forwarding entirely on July 1, 2023. In its announcement it explained that people had "frequently used this feature to host undesirable content and malicious services", leading to law enforcement contact, blacklisted IPs and hosting providers cancelling servers. NordVPN has also cited security concerns as its reason for not offering it.
To stay safe, forward only the ports you need, keep the exposed app updated, use strong passwords and two factor login on any web interface, turn on the VPN's kill switch so the app never falls back to your real IP, and turn port forwarding off when you are done.
Which VPNs offer port forwarding in 2026?
The list is short and getting shorter. Here is where the major providers stand, based on their own support pages.
| VPN | Port forwarding | Cost | Choose your port | Notes |
|---|---|---|---|---|
| Proton VPN | Yes | Included on paid plans | No, assigned | P2P servers, NAT PMP, works in desktop apps and on Linux or routers |
| Private Internet Access | Yes | Included | No, assigned | Most locations, but not its US servers |
| Windscribe | Yes | Included on Pro; permanent ports need a paid Static IP | Static IP only | Ephemeral ports last 7 days |
| PureVPN | Yes | Paid add on | Yes | Pairs with a dedicated IP add on for a fixed address |
| AirVPN | Yes | Included | Yes, from a pool | Popular with advanced users and seeders |
| NordVPN | No | Not offered | Not offered | Meshnet gives private remote access instead |
| Surfshark | No | Not offered | Not offered | Dedicated IP available, but no open ports |
| ExpressVPN | No | Not offered | Not offered | Not supported in its apps |
| Mullvad | No | Removed in 2023 | Not offered | Dropped because of abuse |
Proton VPN: the best all round choice
Proton VPN is the easiest pick for most people. Port forwarding comes with every paid plan at no extra cost, it works on its large network of P2P servers, and the Windows, macOS and Linux apps handle the setup with a single toggle. The app shows the assigned port, which you copy into your torrent client or server. Proton is Swiss, open source, audited for its no logs policy, and its kill switch keeps forwarded traffic inside the tunnel. Our Proton VPN review covers speeds and pricing.
PureVPN: the best for a fixed port and address
PureVPN is the right choice when you need the same port every time, for example a game server friends bookmark or a reverse proxy pointing at a home app. You buy the port forwarding add on, choose which ports to open, and optionally add a dedicated IP so the address never changes. It costs more than the base plan, but it is the closest thing to a static public IP from a commercial VPN. See our PureVPN review for the add on details.
Private Internet Access and Windscribe
Private Internet Access has offered port forwarding for years and turns it on with one switch in its app, though it is not available on its US servers. Windscribe includes ephemeral ports on its Pro plan that expire after 7 days, and sells a Static IP if you want a permanent one, as its port forwarding page explains.
What about NordVPN, Surfshark and ExpressVPN?
The three biggest consumer VPNs all leave port forwarding out on purpose. That does not make them bad choices; it just means they are built for privacy, streaming and speed rather than hosting. NordVPN solves the most common reason people want open ports, reaching their own devices, with Meshnet, which our NordVPN review covers in detail. Surfshark focuses on unlimited devices and value, explained in our Surfshark review, and our ExpressVPN review covers its streaming strengths. For a wider ranking, see our guide to the best VPN overall.
How to set up VPN port forwarding
The exact menus differ by provider, but the process is nearly always the same. Using Proton VPN on a Windows PC as the example:
- Install the VPN app; if you are new to this, follow our guide on how to install a VPN on Windows 11
- Turn on port forwarding in the app settings, then turn on the kill switch
- Connect to a P2P server, marked with a double arrow icon in Proton's server list
- Copy the assigned port number shown in the app once you are connected
- Paste it into your app: in qBittorrent, go to Tools, Options, Connection and set "Port used for incoming connections"; turn off UPnP in the client so it does not open ports on your router
- Allow the app through Windows Firewall if Windows asks
- Test it with your app's own connection check or an online open port checker, using the VPN's IP and the assigned port
Because the port can change when you reconnect, check it each session or use a script that reads the new port over NAT PMP and updates your app automatically. Docker users often run the torrent client inside a container that shares the VPN's network, together with a helper that syncs the port. For a broader look at desktop setups, our best VPN for PC guide compares Windows features such as split tunnelling.
Alternatives to VPN port forwarding
If your provider does not offer port forwarding, or you would rather not expose anything to the internet, these options often work better:
- Mesh VPNs such as NordVPN Meshnet, Tailscale or ZeroTier link your devices into a private network with no public ports; this is the safest way to reach your own server, and it works behind CGNAT
- Reverse tunnels such as Cloudflare Tunnel publish a web app through a cloud relay without opening ports on your router
- Ask your internet provider for a public IPv4 address; many will remove you from CGNAT for free or for a small fee
- Use IPv6, which gives every device its own public address on many connections, though you still need firewall rules
- Rent a small cloud server and run your own WireGuard tunnel from it, which gives you full control over ports
- Forward ports on your router for apps you run without a VPN, if you have a public IP and keep the exposed app patched
Common VPN port forwarding problems and fixes
- Port shows as closed: confirm you are on a P2P server, the app uses the exact assigned port, and the firewall allows it
- Port changed after reconnecting: this is normal; update the app or automate it with NAT PMP
- Works for a while, then stops: some providers expire the port if the session idles; keep the connection active or renew it
- Still slow torrents: an open port helps only when peers exist; old torrents with few seeders stay slow
- Friends cannot join your game: give them the VPN server's IP, not your home IP, and the assigned port, not the game's default
Frequently asked questions
What is VPN port forwarding in simple terms?
It opens one numbered door on the VPN server and sends anything that arrives there through your encrypted tunnel to your device. It lets outside connections reach you while your real IP stays hidden.
Does port forwarding make a VPN faster?
Not for normal browsing or streaming. It can speed up torrents by letting you connect to more peers, but it does not lower your ping or raise your general internet speed.
Is port forwarding needed for torrenting?
No. You can download without it. An open port makes you connectable, which helps on rare torrents and private trackers, so heavy seeders usually want it.
Why did Mullvad remove port forwarding?
Mullvad said the feature was abused to host malicious services, which led to blacklisted IPs and hosting problems for all users. It removed port forwarding on July 1, 2023.
Does NordVPN support port forwarding?
No. NordVPN offers Meshnet instead, which lets you reach your own devices privately without opening any public ports.
Is VPN port forwarding legal?
Yes, in most countries it is a normal networking feature. What you do through the open port still has to follow local law and your provider's terms of service.
Can I forward ports on my router while using a VPN?
You can, but it will not help traffic that goes through the VPN, because outside users only see the VPN server's IP. For VPN traffic, the port has to be opened on the VPN server.
