How to Port Forward on a Zyxel Router

Zyxel routers allow you to forward specific ports to devices on your local network, but creating the rule is only one part of getting an inbound connection to work. The port, protocol, local IP, and WAN connection all need to line up, and the exact menu options you see can vary between Zyxel models.

Your ISP can also affect the result. If the connection uses CGNAT, a correctly configured Zyxel rule may still remain unreachable from the internet. Below, we will cover the manual Zyxel method and how PureVPN Port Forwarding lets you open ports without changing router settings, including on CGNAT connections.

Common Reasons to Port Forward on a Zyxel Router

You may need to forward a port when a device or service on your local network needs to accept connections from the internet. Common examples include:

• Remote NAS access: Forward the port used by the NAS service so you can reach it from outside your local network.
• Hosting a server: A web, FTP, or other server may need incoming traffic on a specific port directed to its local IP address.
• Running a self-hosted application: Some apps require a particular TCP or UDP port to remain reachable from outside the network.

The port you forward depends on the service or application you are using, not the Zyxel router itself.

Port Forwarding on Zyxel Routers: A Step-by-Step Guide

Before you begin, have the local IP address of the device receiving the traffic, the port or port range you need to forward, and the protocol required by the service.

Step #1: Log In to Your Zyxel Router

Open the Zyxel web configurator in your browser and sign in with your administrator credentials. Use the login address and credentials for your specific router, as these can differ by model or ISP configuration.

Step #2: Open the Port Forwarding Settings

Go to Network Setting > NAT > Port Forwarding. This is where Zyxel keeps the rules that direct incoming traffic to devices on your local network. Select Add New Rule to start creating one.

Step #3: Name and Enable the Rule

Turn the rule on, then enter a Service Name that makes it easy to identify later. A clear name is useful if you plan to create separate rules for different devices, ports, or services.

Step #4: Select the WAN Interface and, If Needed, Originating IP

Under WAN Interface, select the internet-facing connection that should receive the incoming traffic. If your Zyxel interface gives you the option to configure an Originating IP, you can enable it and enter the external source IP allowed to use the rule.

Step #5: Enter the Start and End Ports

The Start Port and End Port fields define the external port or range receiving the incoming connection. For a single port, enter the same number in both fields. For a range, enter the first port under Start Port and the last under End Port.

Step #6: Enter the Translation Ports

Enter the Translation Start Port and Translation End Port, which define the internal port or range receiving the traffic. For standard port forwarding, use the corresponding external port numbers. If you want an external port or range to lead to different internal ports, enter different translation values instead.

Step #7: Enter the Server IP Address

Under Server IP Address, enter the local IP address of the device that should receive the forwarded traffic, such as a computer, NAS, or server.

Step #8: Select the Protocol

Choose the protocol required by the service. Zyxel provides TCP, UDP, and TCP/UDP options in this interface. Select TCP/UDP only if the application or service requires both.

Step #9: Save the Rule and Test the Forwarded Port

Select OK to save the changes. Check that the rule is active in the Port Forwarding list. Make sure the device or service receiving the traffic is running, then test the connection using the router’s WAN IP and the port you forwarded. 

Test from outside your local network so the request follows the inbound path you configured. If the rule looks correct but the service is still unreachable from the internet, the issue may be upstream from the router. CGNAT is one possibility, which we will cover next.

Note: Zyxel USG, USG FLEX, ATP, and VPN firewalls use a different process. These devices use a Virtual Server rule under Configuration > Network > NAT and also require a corresponding rule under Configuration > Security Policy > Policy Control to allow the forwarded traffic.

Why Zyxel Port Forwarding May Not Work Behind CGNAT

A port forwarding rule only works if incoming traffic can reach your Zyxel router in the first place. With CGNAT, your ISP or mobile carrier places another NAT layer in front of the router and shares a public IPv4 address between multiple customers. Traffic sent to the port can be stopped before it ever reaches the forwarding rule on your router.

Even with the correct server IP, ports, and protocol, the rule may still be unreachable from the internet. CGNAT comes from the ISP or carrier rather than the Zyxel router itself, and it is especially common on LTE and 5G connections. To confirm it, follow our guide to determine whether your ISP uses CGNAT.

How to Open Ports on Zyxel with PureVPN

PureVPN lets you open ports without changing Zyxel router settings, including on connections affected by CGNAT. Here’s how to do it:

1. Get the Port Forwarding Add-on: Sign in to the PureVPN Member Area, open Subscriptions, find Port Forwarding, and select Get This Add-on to confirm the order.

2. Choose Your Port Settings: Select Configure next to Port Forwarding, then choose to allow all ports, block all ports, or allow specific ports. Enter the required port numbers.

3. Apply the Port Policy: Select Apply Settings once you have chosen the ports. The policy will then be saved to your PureVPN account.

4. Connect to a Supported Location: Open the PureVPN app, connect to a location that supports Port Forwarding, and you are ready to use the ports you selected.

Frequently Asked Questions