Is port forwarding safe? And what about UPnP?

Port forwarding is not dangerous by itself. It opens one door in your router so that something on the internet can reach one device at home. Whether that is safe depends on what sits behind the door, and on who you want to let in.

1. What port forwarding does

At home, all your devices share one internet address: the router's. From the internet, nobody can start a connection to your PC, because the router doesn't know which device it is meant for. That is a quiet, useful kind of protection.

Port forwarding changes that for one port. A port is a number that tells a computer which program a connection is for (web pages use 443, Remote Desktop uses 3389). A forwarding rule says: "Everything that arrives on port 3389, send to the PC at 192.168.1.20." From then on, anyone on the internet can knock on that program, not only you.

Programs called scanners knock on every internet address, all the time, looking for open doors. A new open port is usually found within hours. That does not mean you are hacked. It means the program behind the port must be able to say "no" to strangers, every time.

2. When is port forwarding OK, and when is it risky?

Behind the port	Risk	Why
Game server, game console, voice chat	Usually low	Made to be reached from the internet. Keep it updated.
Media server (e.g. to watch your films away from home)	Low to medium	Fine with updates and a strong password. Better: the app's own remote access, if it has one.
Web server for your own website	Medium	Possible, but it needs updates and care. Many people use a hosting service instead.
Remote Desktop (3389), VNC (5900), SSH (22)	High	Password guessers try thousands of passwords. One weak or reused password is enough.
File sharing / SMB (445), databases, printer, camera, NAS or router admin pages	High	Not made for the open internet. Old security holes in these are used by attackers.

A simple rule: forward a port only for something that is built to face the internet, only to one device, and remove the rule when you no longer need it.

3. Is UPnP safe?

UPnP (Universal Plug and Play) is a router feature that lets programs and devices in your home open ports on the router by themselves. Games, consoles and chat programs use it so that you don't have to set up port forwarding by hand.

• The good side: things just work, and the port is often closed again when the program ends.
• The weak side: UPnP does not ask you. Any program on any device in your network can open a port, and that includes a badly made smart gadget or malware. You may have open ports you never chose.

What we suggest:

1. Open your router's settings page (often printed on the router's label, for example 192.168.1.1 or 192.168.0.1) and look for UPnP. Many routers show a list of the ports UPnP has opened, and by which device.
2. If you don't play online games or use a console, switch UPnP off. Most homes don't need it.
3. If you need it, leave it on, but look at the list now and then. A port you can't explain is worth a closer look.
4. Keep the router's software (firmware) up to date. Router makers fix security holes, also in UPnP.

4. How to test and check port forwarding

1. Look at the router: in its settings, find Port forwarding (sometimes called Virtual server, NAT or Port sharing) and the UPnP list. Write down every open port and the device it goes to. Remove what you don't recognise or don't need.
2. Test from outside: a test from inside your own network often gives the wrong answer, because the router treats it differently. Use an online check that looks at your address from the internet, like our free open-port check. It checks 14 common risky ports (Remote Desktop, file sharing, VNC, databases and more) of your own address.
3. Or test with your phone: switch Wi-Fi off so the phone uses mobile data, then try to reach your game or media server the way a friend would. If it works, the port is open to the whole internet.
4. The program must be running: a forwarded port only shows as open when the program behind it is listening. If a check says "closed" although you set up forwarding, start the program and check the Windows Firewall on that PC.

On the Windows PC itself, you can see which programs are waiting for connections: press Windows key + R, type resmon, open the Network tab and look at Listening Ports.

5. Safer ways to reach your PC from outside

• A VPN: a VPN is a private, encrypted tunnel into your home network. Many routers have one built in. You open only the VPN port, and everything else stays closed.
• The app's own remote access: many media servers, NAS boxes and cameras offer a cloud or app connection that needs no port forwarding.
• Allow only your addresses: some routers, and the Windows Firewall rule's Scope setting, can let in only the internet addresses you name. This works when you always come from the same place.
• Open only when needed: forward the port for the evening, remove the rule afterwards. Or let software do this for you, see below.

And whatever you forward: strong passwords, updates switched on, and the Windows Firewall switched on.

6. See your open doors at any time with Coinetic

Doing this by hand means: logging in to the router now and then, reading port lists, running an online check, and remembering to do it again after every new game, gadget or update. An online check is a one-time look from outside; it does not tell you which program on your PC is behind a port, or who knocked on it last night.

Coinetic works through the Windows Firewall that is already on your Server or PC. No tool can promise 100% security, but you see your open doors and decide what happens to them:

• Every open door, with its program: the Open Ports page lists every port your PC is waiting on, with the program behind it. Right-click to block the port, block the program or stop it.
• A one-click security check: it compares open ports with your firewall rules and tells you what is reachable, in plain words, with a fix you can undo. A program without a digital signature that listens on the network can be closed to the internet with one click, while your home network keeps working.
• You choose for each open port: Coinetic closes it, or makes it invisible forever or until you unlock it from your phone. With Device approval, you tap Unlock on your phone, the port opens only for your phone's internet address, for the hours you chose, and closes again by itself. Your home network and VPN always work. How Device approval works.
• Keep a port open on purpose, and watched: if you accept a port being open, Coinetic records who connects, from which country and for how long, and asks "was that you?" when an unknown address connects for a while.
• Knockers are stopped: port scans are detected and the scanner's address is banned automatically; failed Windows and Remote Desktop logins lead to a ban after the number of tries you choose.
• All of this at any time: not a one-time check. The protection service runs in the background, also when nobody is logged on, and a notification tells you when something needs you.
• Your AI security analyst (Pro + AI): right-click any line, program or connection and choose Ask AI, e.g. “Which of my open ports can be reached from the internet, and do I need them?”. It looks up this computer's Coinetic data itself and answers in plain words, with what to do on this machine.

Coinetic protects the Windows computer it is installed on. It does not change your router: port forwarding and UPnP are still switched off in the router's own settings.

More guides: all Coinetic guides.

Frequently asked

Can someone hack me just because a port is open?

Not by the open port alone. An attacker needs a weakness in the program behind it: a weak password, a missing update or a known security hole. That is why the program matters more than the port number.

Should I switch UPnP off?

If nobody in your home plays online games or uses voice chat that needs it, yes: you lose nothing. If you need it, keep it on, keep the router updated and look at its list of opened ports now and then.

Is the router's firewall enough?

For ports you have not forwarded, the router keeps strangers out well. For a forwarded port, the router lets everything through to your PC, so the Windows Firewall and the program on the PC have to do the rest.

My port check says "closed", but I set up port forwarding. Why?

Usually the program is not running, the Windows Firewall on the PC blocks it, or the rule points to the wrong device (its local address changed). Some internet providers also share one internet address between many customers, and then port forwarding cannot work at all; your provider can tell you.