Port Forwarding & CGNAT
Free Port Forwarding - No Router Access Required
A free port forwarding service that works without router access. Open ports behind CGNAT, T-Mobile, Starlink, or a locked-down ISP router in one command.
What Free Port Forwarding Actually Means
Traditional port forwarding is a router setting. You log into the admin panel, map an external port to an internal device, and hope your ISP cooperates. It costs nothing, so when people search for free port forwarding, they are almost never looking for a price. They are looking for a way to open a port when the router will not let them.
A free port forwarding service solves that differently. Instead of opening a port inward through your router, it opens an outbound connection from your machine to a public endpoint, then routes traffic back down that connection. Your router configuration never changes, because there is nothing to change.
Why Port Forwarding Fails for Most People
If you have already tried the router route and it did not work, one of these is almost certainly why.
You Are Behind CGNAT
Carrier-grade NAT means your ISP shares one public IP across many customers. You do not own an inbound address, so there is no port to forward. This is standard on T-Mobile Home Internet, Starlink, and most mobile and satellite providers.
The router panel may still show a port forwarding page. It simply will not do anything.
You Do Not Control the Router
Dorm networks, office LANs, apartment buildings, and managed ISP gateways all hand you a connection without admin credentials. No credentials, no port forwarding.
Your ISP Blocks the Ports
Many residential providers block 80, 443, and 25 outright to discourage home hosting. The forward saves correctly and the port still reads as closed from outside.
Your IP Keeps Changing
Residential IPs rotate. Even a working forward breaks the next time your lease renews, which is why port forwarding usually drags dynamic DNS along with it.
Port forwarding also exposes your home IP address to everyone who connects, which is a real consideration if you are hosting anything public.
Start free →
Port Forwarding Without Touching Your Router
LocalXpose gives you a public address for a service running on a private machine. It works on CGNAT, on networks you do not administer, and behind blocked ports, because all traffic rides an outbound connection your network already allows.
Install the CLI
npm install -g loclx
# or download a binary from localxpose.io/download Log in
loclx account login Forward the port
# A web app or dashboard on port 8080
loclx tunnel http --to localhost:8080
# A game server, RDP host, or database on a raw TCP port
loclx tunnel tcp --to localhost:25565 You get a public URL or a host:port pair immediately. Point your client, your teammate, or your
game server list at it and the connection reaches your machine.
Start free →
What You Can Forward
| Traffic | Protocol | Plan |
|---|---|---|
| Web apps, dashboards, APIs, webhooks | HTTP/HTTPS | Starter |
| Game servers, RDP, SSH, databases | TCP | Pro |
| Voice, real-time game traffic, CoAP | UDP | Pro |
| Custom TLS services | TLS | Pro |
The free Starter plan covers HTTP and HTTPS, which is enough for anything that speaks web: a local site, a Plex or Home Assistant dashboard, a webhook endpoint, a self-hosted admin panel. Raw TCP and UDP forwarding are on the Pro plan at $8/month.
Common Reasons People Need This
Hosting a game server for friends. Run Minecraft, Terraria, or Valheim from your own machine without opening 25565 on the router.
Remote desktop into a home PC. Reach an RDP host from outside the network when the router will not forward 3389.
Viewing a security camera remotely. Get to an IP camera feed without exposing it on your home IP.
Reaching a media server. Stream from a machine at home while travelling, including Plex and similar self-hosted media stacks.
Running a homelab. If the goal is broader than one port, see accessing your home server from anywhere.
Testing webhooks against localhost. Stripe, GitHub, and Slack need a reachable URL. A tunnel gives you one without deploying anything.
LocalXpose vs Router Port Forwarding
| Feature | Router Port Forwarding | LocalXpose |
|---|---|---|
| Works behind CGNAT | ✗ Not possible | ✓ Yes |
| Needs router admin access | ✗ Required | ✓ Never touches the router |
| Survives IP changes | ✗ Needs dynamic DNS | ✓ Address stays stable |
| Exposes your home IP | ✗ Yes | ✓ No |
| HTTPS certificates | ✗ Set up yourself | ✓ Automatic |
| Setup time | 15-45 minutes | About 1 minute |
| Blocked ports (80, 443, 25) | ✗ ISP decides | ✓ Unaffected |
Pricing
Starter
$0
- 2 active HTTP, HTTPS tunnels
- SSL/TLS encryption
- Unique subdomains
- Works on your machine
- – Time limits
- – Interstitial warning page
Pro
Popular$8/mo
- 10 tunnels included
- HTTP, HTTPS, TCP, TLS, UDP tunneling
- TCP, UDP port forwarding
- Custom subdomains
- Custom domains
- Wildcard tunnels
- Automatic certificates
- 24/7 availability
- Unlimited bandwidth
Starter needs no credit card. Pro is $8/month, or $96/yr if billed annually.
Frequently Asked Questions
Is there a free port forwarder available?
Yes. The Starter plan forwards HTTP and HTTPS traffic for free, with no credit card. Tunnels are time limited and visitors see an interstitial warning page. Raw TCP and UDP forwarding, unlimited bandwidth, and uninterrupted tunnels are on the $8/month Pro plan.
Is there a free service for port forwarding behind CGNAT?
This is the main reason to use one. CGNAT removes your inbound public address entirely, so no router setting can fix it. A tunnel works because the connection is established outbound from your machine.
Can I host a game server without port forwarding?
Yes. Forward the game’s port over TCP or UDP and share the public address with players. Nothing changes on your router and your home IP stays private.
Is this the same as a VPN with port forwarding?
No. A VPN with port forwarding routes your traffic through a provider and assigns you a port on their exit IP, and everyone connecting needs the VPN or the exact port. A tunnel publishes one service at one address that anyone can reach directly.
Do I need dynamic DNS?
No. Dynamic DNS exists to track a changing home IP. Your tunnel address does not depend on your home IP, so there is nothing to track.
What about port forwarding software for the router itself?
Tools like UPnP helpers still depend on the router owning a public IP and permitting the change. They cannot help behind CGNAT or on a network you do not administer. For a broader look at protocol options, see our tunneling service overview.
Open the port your router will not
Works on CGNAT, mobile and satellite ISPs, and locked-down networks. One command, no router login.
Get started free →