CVConnection Vitals
Diagnose
Home / Diagnosis
Live connection diagnosis

Port Forwarding Test

Verify the path, then identify why a forwarded TCP port still cannot be reached.

Port forwarding diagnosis

Confirm the local service first, probe the public path, then use WAN/public IPv4 evidence if the port is not reachable.

Measured evidence first
Detected public IPChecking…
IP version—
Network—

The public IP shown here is detected from this browser request. External probes are restricted to that same public IP.

Does the service work on your home network?
One port only. No ranges or bulk scans.
Find this in your router's Internet/WAN status. It is used only for NAT diagnosis.

The correct order prevents wasted router changes

  1. Confirm the application works on the LAN.
  2. Probe the public TCP port from outside.
  3. If it fails, compare router WAN IPv4 with the detected public IPv4.
  4. Only then focus on forwarding target, firewall and application binding.
Important: the test reports reachable / not reachable. It does not pretend a TCP connect failure has full Nmap-style closed/filtered certainty.

Frequently asked questions

Why can a forwarded port still appear unreachable?

The service may not be listening, the forwarding rule may target the wrong LAN host, a firewall may block it, or another NAT layer may exist upstream.

Does a different WAN IP always mean CGNAT?

No. An address in 100.64.0.0/10 strongly indicates carrier-grade NAT; RFC1918 addresses indicate another private NAT layer. A different public address needs more investigation.

When the forwarded port is still unreachable

Do not keep editing the same rule until you know which layer is failing.

Check for CGNAT

Use the WAN/public IPv4 comparison instead of inferring CGNAT from a closed port.