Network address translation (NAT) is the process that routes traffic between public and private IP addresses, so that data arriving at your router, for example, can be directed to the correct device on your local network.
Your router has a NAT firewall to block any unexpected traffic and keep your devices safe. It can be one of three NAT types: Open, Moderate, or Strict.
A strict NAT type is best for security, but it makes it harder for external devices to communicate with your devices, especially on peer-to-peer connections.
Port forwarding is a process where you manually open a port and assign it to certain types of network traffic. It speeds up some applications, such as torrenting and gaming, and enables torrents to be seeded.
![How port forwarding works diagram](https://www.top10vpn.com/images/2022/07/how-port-forwarding-works.jpg)
Port forwarding allows devices on the internet to access specific devices within your local area network.
If port forwarding is provided through your VPN software, it will be port forwarding from the public IP address of the VPN server you’re connected to, to a port on your local device.
There are security risks, though: port forwarding bypasses the NAT firewall, which protects you from malicious internet traffic. It can also cause IP leaks when torrenting with a VPN, which means your real identity could be exposed.
Because of these risks, few VPNs allow port forwarding. Out of the 62 VPNs we’ve reviewed, only 12 currently support it. AirVPN has the best customization options, but Private Internet Access is our highest-rated VPN with port forwarding.
Best Practices for VPN Port Forwarding
Your VPN will close all the ports that it doesn’t need for its secure VPN tunnel. That helps to ensure that no traffic leaks and your device is safe from external threats.
However, if you use port forwarding, you will bypass your VPN’s firewall, and open up an external port. This may expose you to some of the security risks we mentioned above.
To minimise your risk:
- Use a reputable VPN. The port fail vulnerability was identified in 2015 and enables someone to discover the true IP address of somebody with port forwarding enabled. Although the attack is somewhat elaborate and uncommon, reputable VPNs quickly protected against it.
- Limit your exposure. Only open the ports required for your gaming, torrenting, or other applications. Close them when you’ve finished.
- Use strong passwords. Protect your game servers and other software with strong passwords that you regularly change. This helps to protect against brute-force attacks.
- Patch. Update your software regularly to remove known security vulnerabilities.
- Keep it secret. Don’t share your public IP address or open port number in public forums.
- Protect your anonymity. Port forwarding requires a static IP address, which is a privacy vulnerability when combined with an open port number. Change the port you’re forwarding regularly, and use a private payment method to protect your identity. Private Internet Access automatically selects a random port for you, to help protect your privacy.