Port Forwarding
A router rule that directs incoming internet traffic on a specific port to a device on your local network.
Port forwarding lets you reach a home service from the internet, but it also exposes that service to attackers. Prefer a VPN like WireGuard or Tailscale, or a reverse proxy with authentication and TLS. If you must forward ports, forward as few as possible and keep the service patched.
The risk is easy to underestimate: any port you open is continuously scanned and probed by automated bots within minutes, so an unpatched or weakly-authenticated service can be compromised quickly. Never forward management interfaces (a NAS UI, Proxmox, router admin, SSH with passwords) directly. The safest architecture is to forward nothing for personal use and reach everything over a VPN, reserving public exposure — behind a reverse proxy with HTTPS and strong authentication — only for the handful of services you deliberately share. If your ISP uses CGNAT you can't port-forward at all, which is another reason mesh VPNs and tunnels have become popular.
Related articles
Reverse Proxy
A server that sits in front of your services, routing requests by domain name and handling TLS certificates.
VPN(Virtual Private Network)
An encrypted tunnel that lets you securely access your home network from anywhere as if you were local.
SSH(Secure Shell)
An encrypted protocol for securely logging into and managing servers over a network.