Port Forwarding Not Working, Router, NAT and CGNAT Fixes
Port forwarding fails more often because of something outside the rule than because of the rule itself. The service must be listening, the device firewall must allow it, the router must forward the right protocol, and the router's WAN address must actually be reachable from the internet. If your provider puts you behind CGNAT, normal port forwarding cannot work at all.
The fix, in order
Prove the service works locally first. On the target device, check that the service is running and listening on the right port, and that you can reach it from another device on the same network. A rule cannot forward traffic to a service that is not listening.
Give the device a fixed address. Set a static DHCP reservation for the target device in the router admin page, so its local address never changes. A rule pointing at an old address silently stops working after a reboot.
Check the rule itself. Confirm the rule forwards the correct port and the correct protocol, TCP, UDP, or both, to the correct local address and port. If you are unsure which port a service uses, look it up in the port numbers directory. Save the rule and restart the router if the admin page asks for it.
Allow the port through the device firewall. The router can forward traffic that the computer's own firewall then blocks. Add an inbound rule for the port on the target device, and check that the service is bound to the local network address, not only to 127.0.0.1.
Check for double NAT and CGNAT. In the router admin page, find the WAN or internet IP address and compare it with the public IP shown by the IP address lookup tool. If the WAN address starts with 10., 172.16. to 172.31., or 192.168., there is another router upstream, put the upstream device in bridge mode or forward on both devices. If it starts with 100.64. to 100.127., you are behind CGNAT.
Test from outside your network. Test the port from a phone on mobile data or a friend's connection, not from your own network. Testing your own public address from inside the LAN depends on NAT loopback, which many routers do not support, and a false failure is the result.
Do not open ports you do not need, and never forward a port to a device you do not control. Every open port is a door into your network, so remove rules when you stop using them.
If it still happens
If the WAN address is a CGNAT address in the 100.64.0.0/10 range and your provider will not give you a public IPv4 address, normal inbound port forwarding cannot work, because unsolicited traffic stops at the provider's NAT before it reaches your router. Ask your provider through its official support channel for a public IPv4 address, or consider an outbound tunnel service or native IPv6 if your provider supports it. Adding more router rules will not fix CGNAT.
Common questions
What is CGNAT and why does it break port forwarding? Carrier-grade NAT means your provider shares one public IPv4 address among many customers, and your router gets a private address instead. Your forwarding rule only controls your router, not the provider's NAT, so inbound traffic never reaches you.
Why does the port checker say closed when my rule is saved? A saved rule only proves the router accepted your settings. The port can still show closed if the service is not listening, the firewall blocks it, the protocol is wrong, or CGNAT or double NAT sits upstream.
Does DDNS fix port forwarding behind CGNAT? No. Dynamic DNS only gives a name to an IP address, it does not create an inbound route through the provider's NAT. The address it names is still unreachable from the outside.