Before understanding port forwarding, you need to understand the network layers:
[Your Device]
↓
[Home Router] ← has your PUBLIC IP (given by ISP)
↓
[ISP Network]
↓
[Internet]
Two types of IP addresses exist in your home:
Type
Example
Who assigns it
Visible to internet
Private/Local IP
192.168.1.10
Your router
No
Public IP
203.45.67.89
Your ISP
Yes
Your router uses a technique called NAT (Network Address Translation) to let multiple private devices share one public IP.
2. What is NAT?
NAT is what your router does automatically for outbound traffic:
Your laptop (192.168.1.10) wants to open Google.com
Step 1: Laptop sends request
Source: 192.168.1.10:54321 → Destination: 142.250.80.46:443
Step 2: Router translates it
Source: 203.45.67.89:54321 → Destination: 142.250.80.46:443
(replaces private IP with public IP)
Step 3: Google responds
Source: 142.250.80.46:443 → Destination: 203.45.67.89:54321
Step 4: Router translates back
Knows port 54321 belongs to 192.168.1.10
Delivers response to your laptop
NAT works perfectly for outbound (you initiate). But for inbound (someone outside initiates), the router has no idea which internal device to forward it to — so it drops the packet.
3. The Inbound Problem
Scenario: You have a backend server at 192.168.1.10:3000
Vercel tries to call your backend
Vercel → 203.45.67.89:3000 → Your Router
↓
Router thinks:
"Who wants port 3000?
I have no rule for this.
DROP."
↓
Vercel gets no response
Connection timeout
4. Port Forwarding Solves This
You go into your router admin panel (usually 192.168.1.1) and add a rule:
External Port 3000 → Internal IP 192.168.1.10 → Internal Port 3000
Now:
Vercel → 203.45.67.89:3000 → Your Router
↓
Router checks rules:
"Port 3000? Forward to 192.168.1.10:3000"
↓
Your Backend Server ✓
5. Types of Port Forwarding
Single Port Forwarding
External 3000 → Internal 192.168.1.10:3000
One specific port to one specific machine
Port Range Forwarding
External 3000-3010 → Internal 192.168.1.10
Useful for apps that use multiple ports
DMZ (Demilitarized Zone)
ALL ports → Internal 192.168.1.10
Completely exposes one machine to internet
Extremely dangerous — last resort only
6. Dynamic IP Problem
Your ISP assigns your public IP — and it changes periodically:
Monday: Your public IP = 203.45.67.89 ✓ (Vercel configured to this)
Tuesday: ISP changes it = 203.45.70.12 ✗ (Vercel still calls old IP)
→ Everything breaks
Solutions:
Static IP — request a fixed IP from your ISP (costs extra money monthly)
DDNS (Dynamic DNS) — a service that tracks your changing IP and maps it to a fixed domain name (e.g., myserver.ddns.net)
7. Security Risks in Detail
Risk 1 — Port Scanning
Bots on the internet constantly scan all IPs:
"203.45.67.89:22 open? → try SSH brute force"
"203.45.67.89:3000 open? → try exploit"
This happens within minutes of opening a port
Risk 2 — Application Vulnerabilities
If your backend has a bug/vulnerability,
it is now directly accessible to the entire internet
One exploit → attacker inside your network
Risk 3 — No Encryption
Port forwarding just forwards raw TCP/UDP packets
No encryption added automatically
Anyone sniffing the network can read the data
You must add SSL/TLS yourself
Risk 4 — Lateral Movement
Attacker compromises your exposed backend
→ They are now inside your LAN (192.168.x.x)
→ Can attack your other devices (PC, NAS, cameras)
→ Your entire home/office network is at risk
8. How Tailscale Avoids All This
Traditional Port Forwarding:
[Internet — hostile] ←→ [Open Port] ←→ [Your Server]
(anyone can knock)
Tailscale:
[Your Server] ──outbound──→ [Tailscale Coordination Server]
↑
[Vercel joins same tailnet]
[Direct encrypted P2P tunnel]
No inbound ports opened.
No public exposure.
Only authenticated tailnet members can connect.
WireGuard encryption on all traffic.
9. Quick Reference Summary
Port Forwarding:
✓ Simple to set up
✓ No extra software
✗ Exposes server to internet
✗ Requires static/DDNS IP
✗ No encryption by default
✗ Security risk if misconfigured
✗ Bots will find and probe your open ports
Tailscale:
✓ No open ports
✓ No public exposure
✓ WireGuard encryption built-in
✓ IP doesn't matter (works on dynamic IP)
✓ Only your devices can connect
✗ Requires Tailscale on both ends
✗ Slightly more setup initially
10. One Line Summary
Port forwarding = cutting a hole in your wall and hoping only the right person walks through.
Tailscale = giving a secret private tunnel only to people you trust.