🌐 Port Forwarding Guide (Double NAT: Modem + Router)

This guide explains how to properly configure port forwarding in a double NAT environment (ISP modem + personal router) in order to host services from a local network.

This setup is commonly required for:

• Custom Nintendo WFC / GameSpy server hosting
• Mario Kart Wii server infrastructure
• Self-hosted DNS servers
• NATNEG services
• Web servers
• Custom multiplayer game servers

---

📌 Network Requirements

Before starting, ensure you have:

• ✅ A Public IPv4 Address

  • Must NOT be behind CGNAT (Carrier-Grade NAT)
  • Verify by comparing:
    • WAN IP shown in router settings
    • IP shown on https://whatismyipaddress.com
  • If they do not match → contact your ISP and request a public/static IPv4.

• ✅ ISP Modem with:

  • DMZ support OR
  • Bridge mode capability

• ✅ Personal Router with:

  • Port forwarding support
  • Ability to reserve static LAN IPs

• ✅ Stable internet connection

---

🧠 Understanding Double NAT

If your setup looks like this:

Internet ↓ ISP Modem (NAT #1) ↓ Personal Router (NAT #2) ↓ Server PC

You must pass traffic through both NAT layers.

Failure to properly forward through both layers will result in closed ports.

---

⚙️ Configuration Steps

---

Step 1 — Assign a Static LAN IP to Your Server

Port forwarding requires a fixed internal IP address.

Option A (Recommended)

Reserve a DHCP address in your router for your server device.

Option B

Manually set a static IP on the server machine.

Example configuration:

IP Address: 192.168.1.50 Subnet Mask: 255.255.255.0 Gateway: 192.168.1.1

---

Step 2 — Configure ISP Modem

Login to your modem’s admin panel.

Option A — Enable Bridge Mode (Preferred)

If available:

• Enable Bridge Mode
• This disables NAT on the modem
• Your router becomes the only NAT device

This is the cleanest configuration.

---

Option B — Use DMZ to Router (If Bridge Mode Not Available)

If bridge mode is unavailable:

1. Enable DMZ on the modem
2. Set DMZ target to your router’s WAN IP

Example:

Router WAN IP: 192.168.0.2

This forwards all inbound traffic to your router.

⚠️ Only use this method if your router firewall is enabled and properly configured.

---

Step 3 — Configure Router Settings

Login to your personal router.

Recommended Settings:

• Disable UPnP (prevents automatic port conflicts)
• Keep router firewall enabled

⚠️ You do NOT need DMZ enabled on both modem and router in most cases.

---

Step 4 — Create Port Forwarding Rules

Navigate to:

Advanced → Port Forwarding / Virtual Server

Add rules for each required service.

Example table:

Service	Protocol	External Port	Internal IP	Internal Port
GameSpy QR	UDP	27900-27950	192.168.1.50	Same
NAS	TCP	80	192.168.1.50	80
Custom DNS	UDP	53	192.168.1.50	53

Important:

• Internal IP = Server’s static LAN IP
• External IP = Your public IPv4

Users will connect using:

your-public-ip:port

NOT your private IP address.

---

🔍 Verification

1 — Confirm Public IP

Check your router’s WAN IP.

It must match: https://whatismyipaddress.com

If it does not match → you are behind CGNAT.

---

2 — Test Open Ports

Use one of the following:

• https://canyouseeme.org
• External VPS:

nmap your-public-ip

---

🔐 Security Recommendations

Since you are exposing ports to the internet:

• Keep modem and router firmware updated
• Forward only required ports
• Use firewall rules where possible
• Monitor logs
• Consider:
  • Reverse proxy
  • VPS relay
  • Fail2ban (Linux)

---

🚨 Common Mistakes

• ❌ Using private IP instead of public IP
• ❌ Forgetting to assign static LAN IP
• ❌ Forwarding ports only on router but not modem
• ❌ Being behind CGNAT
• ❌ UPnP conflicting with manual rules
• ❌ Enabling unnecessary DMZ on multiple devices

---

🖥 Example Network Diagram

[ Internet ] ↓ [ ISP Modem ] (DMZ → Router OR Bridge Mode) ↓ [ Personal Router ] (Port Forwarding Rules) ↓ [ Server PC ]

---

📘 Summary

To successfully port forward in a double NAT environment:

1. Obtain a public IPv4 address
2. Assign a static LAN IP to your server
3. Bridge modem OR DMZ modem to router
4. Configure port forwarding rules on router
5. Verify ports are open externally

---

🏁 Final Notes

This configuration allows external users to access services hosted on your local machine using your public IP address.

Always verify security settings before exposing services publicly.