Keep a private record of a port mapping

Keep each endpoint and port role clear

A VPN-provider forwarding rule is configured at that provider's endpoint. A home-router rule directs traffic to a service on a device in the local network. A remote-access VPN is another pattern: a client authenticates into a private network rather than making a service's port publicly reachable. These are different paths. Choose the entry that matches the actual rule you are reviewing.

Record the external port shown by the provider or router and the destination port where the app listens as separate values, even when the numbers happen to match. Write TCP or UDP beside the values: the same number with different transport protocols represents different endpoints. Some providers assign a port dynamically, and its value may change after reconnecting. Follow the provider's current instructions instead of relying on an old record.

Port numbers range from 0 through 65535, but this worksheet accepts 1 through 65535 for a service mapping. The IETF registry reserves and classifies port-number ranges, and client applications can also use automatically selected ephemeral source ports for outgoing connections. A source port in a connection log is not automatically the service's listening port.

Review the service before exposing it

1. Confirm that inbound reachability is needed for the named app and that the chosen endpoint is the one its instructions describe.
2. Check the exact provider or router documentation for plan, platform, protocol, server, and port requirements. Feature support and behavior can differ.
3. Confirm that the intended app is listening, has suitable authentication, and is updated. Do not expose an administration page or other sensitive service as a shortcut.
4. If you use an external port checker, use it only for an endpoint and service you control. A closed result can have several causes; an open result only shows that a listener responded at that moment.
5. Remove rules you no longer need and review the entry after changing the server, device, app, or network path.

This worksheet validates only whether entered port values are whole numbers in its accepted range. It does not configure an account or router, scan a device, test reachability, identify the service, or determine whether it is secure. Keep a completed record private.

See the VPN port-forwarding guide for the distinction between provider forwarding, home-router rules, and remote access. If your goal is reaching a home service from outside, review options for remote access behind CGNAT before relying on a router rule.

How it works

Add a non-sensitive rule label, choose where it is configured, and enter the transport protocol plus external and destination ports from the current official instructions. The worksheet only checks port-number format and summarizes your entries; it does not configure, scan, or verify a network.