This page replaces the old wiki FAQ pages FAQ.FirewallsRouters and FAQ.FirewallsRouters.Comodo. The Comodo firewall vendor once linked to the latter. The principles below apply to any application that accepts inbound connections.
Two different barriers
| Barrier | What it does | Typical fix |
|---|---|---|
| Software firewall (Windows Defender Firewall, third-party suites) | Decides which programs may send/receive traffic on your computer | Allow the program for TCP and UDP on private networks |
| Router / NAT | Shares one public IP among your devices; drops unsolicited inbound connections | Port forwarding or UPnP |
Allowing an app in a software firewall
- Windows: Windows Security → Firewall & network protection → Allow an app through firewall. Allow it on Private networks. Avoid Public unless you need it.
- Third-party suites: many add their own application rules on top of Windows. If an app works with the suite disabled but not enabled, add an explicit rule there, for TCP and UDP, inbound and outbound, rather than turning protection off.
Port forwarding step by step
- Choose a fixed listening port in your application.
- Give your computer a stable local address: a DHCP reservation in the router is easiest.
- In the router admin page, forward that port for both TCP and UDP to the computer’s local address.
- Confirm the app no longer reports “firewalled”.
Forward only the ports you need, to only the device that needs them, and remove rules you no longer use.
UPnP: convenience vs risk
UPnP lets applications open router ports automatically. It’s convenient, but any software on your network, including malware, can use it to expose services. If you enable it, keep router firmware updated and check the router’s UPnP mapping table occasionally. Many security guides recommend disabling it and forwarding ports manually.
When forwarding is impossible
- CGNAT: your ISP places you behind a shared public IP, so you can’t forward ports from your router. Some ISPs offer a public IPv4 or IPv6 on request.
- IPv6: devices may get globally routable addresses, but the router’s IPv6 firewall still blocks inbound traffic until you allow it.
- VPN: inbound connections only work if the VPN provider supports port forwarding.
Security checklist
- Change the router’s default admin password and disable remote administration.
- Never forward ports for remote-desktop or admin interfaces directly to the internet. Use a VPN instead.
- Check your public IP and exposure with our IP checker.