Asia/Calcutta
Posts

Port Forwarding — Deep Dive

March 21, 2026
Before understanding port forwarding, you need to understand the network layers:
[Your Device]
     ↓
[Home Router]  ← has your PUBLIC IP (given by ISP)
     ↓
[ISP Network]
     ↓
[Internet]
Two types of IP addresses exist in your home:
TypeExampleWho assigns itVisible to internet
Private/Local IP192.168.1.10Your routerNo
Public IP203.45.67.89Your ISPYes
Your router uses a technique called NAT (Network Address Translation) to let multiple private devices share one public IP.
NAT is what your router does automatically for outbound traffic:
Your laptop (192.168.1.10) wants to open Google.com

Step 1: Laptop sends request
        Source: 192.168.1.10:54321 → Destination: 142.250.80.46:443

Step 2: Router translates it
        Source: 203.45.67.89:54321 → Destination: 142.250.80.46:443
        (replaces private IP with public IP)

Step 3: Google responds
        Source: 142.250.80.46:443 → Destination: 203.45.67.89:54321

Step 4: Router translates back
        Knows port 54321 belongs to 192.168.1.10
        Delivers response to your laptop
NAT works perfectly for outbound (you initiate). But for inbound (someone outside initiates), the router has no idea which internal device to forward it to — so it drops the packet.
Scenario: You have a backend server at 192.168.1.10:3000
          Vercel tries to call your backend

Vercel → 203.45.67.89:3000 → Your Router
                                    ↓
                              Router thinks:
                              "Who wants port 3000?
                               I have no rule for this.
                               DROP."
                                    ↓
                              Vercel gets no response
                              Connection timeout

You go into your router admin panel (usually 192.168.1.1) and add a rule:
External Port 3000  →  Internal IP 192.168.1.10  →  Internal Port 3000
Now:
Vercel → 203.45.67.89:3000 → Your Router
                                    ↓
                              Router checks rules:
                              "Port 3000? Forward to 192.168.1.10:3000"
                                    ↓
                              Your Backend Server ✓

Single Port Forwarding
External 3000 → Internal 192.168.1.10:3000
One specific port to one specific machine
Port Range Forwarding
External 3000-3010 → Internal 192.168.1.10
Useful for apps that use multiple ports
DMZ (Demilitarized Zone)
ALL ports → Internal 192.168.1.10
Completely exposes one machine to internet
Extremely dangerous — last resort only

Your ISP assigns your public IP — and it changes periodically:
Monday:    Your public IP = 203.45.67.89  ✓ (Vercel configured to this)
Tuesday:   ISP changes it = 203.45.70.12  ✗ (Vercel still calls old IP)
           → Everything breaks
Solutions:
  • Static IP — request a fixed IP from your ISP (costs extra money monthly)
  • DDNS (Dynamic DNS) — a service that tracks your changing IP and maps it to a fixed domain name (e.g., myserver.ddns.net)

Risk 1 — Port Scanning
Bots on the internet constantly scan all IPs:
"203.45.67.89:22 open? → try SSH brute force"
"203.45.67.89:3000 open? → try exploit"
This happens within minutes of opening a port
Risk 2 — Application Vulnerabilities
If your backend has a bug/vulnerability,
it is now directly accessible to the entire internet
One exploit → attacker inside your network
Risk 3 — No Encryption
Port forwarding just forwards raw TCP/UDP packets
No encryption added automatically
Anyone sniffing the network can read the data
You must add SSL/TLS yourself
Risk 4 — Lateral Movement
Attacker compromises your exposed backend
→ They are now inside your LAN (192.168.x.x)
→ Can attack your other devices (PC, NAS, cameras)
→ Your entire home/office network is at risk

Traditional Port Forwarding:
[Internet — hostile] ←→ [Open Port] ←→ [Your Server]
                         (anyone can knock)

Tailscale:
[Your Server] ──outbound──→ [Tailscale Coordination Server]
                                        ↑
                             [Vercel joins same tailnet]
                             [Direct encrypted P2P tunnel]

No inbound ports opened.
No public exposure.
Only authenticated tailnet members can connect.
WireGuard encryption on all traffic.

Port Forwarding:
✓ Simple to set up
✓ No extra software
✗ Exposes server to internet
✗ Requires static/DDNS IP
✗ No encryption by default
✗ Security risk if misconfigured
✗ Bots will find and probe your open ports

Tailscale:
✓ No open ports
✓ No public exposure
✓ WireGuard encryption built-in
✓ IP doesn't matter (works on dynamic IP)
✓ Only your devices can connect
✗ Requires Tailscale on both ends
✗ Slightly more setup initially

Port forwarding = cutting a hole in your wall and hoping only the right person walks through. Tailscale = giving a secret private tunnel only to people you trust.