Setting Up Port Forwarding for Raspberry Pi
One of the most useful things about a Raspberry Pi is that you can use it as a server. Do you host a website on your raspberry pi ? Run a home automation system ? Manage files ? Monitor security cameras ? Access your Pi remotely ? Port forwarding lets you access your raspberry pi from anywhere in the world .
Port forwarding can be intimidating to many beginners as it involves routers, IP addresses, firewalls, and networking concepts. But once you know the basics, setting up port forwarding is pretty easy.
In this guide, we’ll explain what port forwarding is, why you need it, how it works, and how to safely configure it for a Raspberry Pi.
What Is Port Forwarding?
Port forwarding is a networking technique that directs incoming internet traffic to a specific device on your local network.
Every device connected to your home router has a private IP address. These addresses are not directly accessible from the internet.
For example:
| Device | Local IP Address |
|---|---|
| Router | 192.168.1.1 |
| Raspberry Pi | 192.168.1.100 |
| Laptop | 192.168.1.101 |
| Phone | 192.168.1.102 |
From outside your home network, people can only see your router’s public IP address.
Port forwarding tells the router:
“When traffic arrives on a specific port, send it to the Raspberry Pi.”
Without port forwarding, incoming requests stop at the router and never reach the Pi.
Why Use Port Forwarding?
Common Raspberry Pi projects that benefit from port forwarding include:
Remote SSH Access
Access the Pi command line from anywhere.
Personal Website Hosting
Run a web server using Apache, Nginx, or Lighttpd.
Home Automation
Access Home Assistant remotely.
Security Cameras
View camera feeds while away from home.
VPN Servers
Connect securely back to your home network.
Game Servers
Host multiplayer games on a Raspberry Pi.
File Servers
Access documents and backups remotely.
Media Servers
Stream content from a home media collection.
Understanding Ports
Ports are logical communication channels.
A single IP address can provide many services simultaneously because each service uses a different port.
Examples include:
| Service | Default Port |
|---|---|
| HTTP | 80 |
| HTTPS | 443 |
| SSH | 22 |
| FTP | 21 |
| MQTT | 1883 |
| VNC | 5900 |
| Home Assistant | 8123 |
When someone connects to:
203.0.113.10:80
the router knows they want the web service.
When someone connects to:
203.0.113.10:22
they want SSH access.
Port forwarding tells the router which internal device should receive those requests.
How Port Forwarding Works
Suppose:
- Public IP: 81.100.200.50
- Raspberry Pi IP: 192.168.1.100
- SSH Port: 22
The router rule might be:
| External Port | Internal IP | Internal Port |
|---|---|---|
| 2222 | 192.168.1.100 | 22 |
Now when someone connects to:
81.100.200.50:2222
the router forwards the request to:
192.168.1.100:22
The user gains access to the Raspberry Pi SSH service.
Step 1: Give Your Raspberry Pi a Static IP Address
Before creating forwarding rules, ensure the Pi always uses the same internal IP address.
Without a static address, the router could assign a different IP after rebooting.
Check current IP:
hostname -I
Example:
192.168.1.100
DHCP Reservation vs Static Configuration
There are two common approaches.
DHCP Reservation (Recommended)
Most routers allow you to reserve an address for a device.
Advantages:
- Easy to manage
- Prevents conflicts
- Centralized configuration
Simply reserve the Raspberry Pi’s MAC address in the router.
Static IP on Raspberry Pi
Edit:
sudo nano /etc/dhcpcd.conf
Example:
interface eth0
static ip_address=192.168.1.100/24
static routers=192.168.1.1
static domain_name_servers=192.168.1.1
Restart:
sudo reboot
Step 2: Identify Services Running on Raspberry Pi
Determine which service you want to expose.
Check listening ports:
sudo ss -tulnp
Example output:
tcp LISTEN 0 128 *:22
tcp LISTEN 0 128 *:80
tcp LISTEN 0 128 *:443
This confirms:
- SSH running on port 22
- HTTP running on port 80
- HTTPS running on port 443
Step 3: Log Into Your Router
Open a browser and enter:
192.168.1.1
or
192.168.0.1
depending on your router.
Typical sections include:
- Port Forwarding
- Virtual Servers
- NAT Rules
- Applications and Gaming
- Advanced Settings
Manufacturers use different names, but the concept is identical.
Step 4: Create a Port Forwarding Rule
Suppose SSH access is required.
Configuration:
| Setting | Value |
|---|---|
| Service Name | Raspberry Pi SSH |
| External Port | 2222 |
| Internal IP | 192.168.1.100 |
| Internal Port | 22 |
| Protocol | TCP |
Save and apply.
Why Use External Port 2222 Instead of 22?
Many administrators avoid exposing port 22 directly.
Using:
External: 2222
Internal: 22
reduces automated scanning attempts.
Although it is not true security, it helps reduce noise in logs.
Step 5: Determine Your Public IP Address
Your public IP is assigned by your ISP.
You can find it through your router status page.
Example:
81.100.200.50
Remote connections use:
81.100.200.50:2222
instead of:
192.168.1.100
because local addresses are inaccessible from the internet.
Step 6: Test Remote Access
Testing from inside the same network can be unreliable because some routers lack NAT loopback support.
Use:
- Mobile phone on cellular data
- Remote computer
- Friend’s network
- Cloud server
SSH example:
ssh pi@81.100.200.50 -p 2222
If successful, the Raspberry Pi login prompt appears.
Port Forwarding for a Web Server
Suppose the Pi hosts a website.
Create:
| External Port | Internal Port |
|---|---|
| 80 | 80 |
| 443 | 443 |
The router forwards visitors directly to the Raspberry Pi web server.
Users simply visit:
http://your-public-ip
or
https://your-public-ip
Port Forwarding for Home Assistant
Default Home Assistant port:
8123
Rule:
| External | Internal |
|---|---|
| 8123 | 8123 |
Visitors connect using:
public-ip:8123
Many users place Home Assistant behind HTTPS for better security.
Port Forwarding for VNC
VNC default port:
5900
Forward:
| External | Internal |
|---|---|
| 5900 | 5900 |
Remote VNC clients can then connect to the Pi desktop.
However, direct VNC exposure is generally discouraged without additional security.
Security Risks of Port Forwarding
Port forwarding creates a path from the internet directly to your Raspberry Pi.
This means attackers can attempt:
- Password guessing
- Vulnerability scanning
- Exploit attempts
- Denial-of-service attacks
- Automated bot attacks
Security should always be considered before opening ports.
Best Security Practices
Use Strong Passwords
Avoid:
raspberry
123456
password
Use long, random passwords.
Enable SSH Keys
SSH keys are far safer than passwords.
Generate a key pair:
ssh-keygen
Copy to Raspberry Pi:
ssh-copy-id pi@192.168.1.100
Disable password authentication afterward.
Change Default User
Many attacks specifically target:
pi
Creating a custom user reduces exposure.
Keep Raspberry Pi Updated
Update regularly:
sudo apt update
sudo apt full-upgrade
Security patches are critical.
Enable a Firewall
Install UFW:
sudo apt install ufw
Allow SSH:
sudo ufw allow 22/tcp
Enable firewall:
sudo ufw enable
Use Fail2Ban
Fail2Ban blocks repeated login attempts automatically.
Install:
sudo apt install fail2ban
This significantly improves SSH security.
Dynamic DNS and Port Forwarding
Many ISPs change public IP addresses periodically.
If your IP changes:
81.100.200.50
might become:
81.100.201.75
making previous bookmarks invalid.
Dynamic DNS solves this issue by linking a hostname to your changing IP address.
Examples:
mypi.example-domain.com
The hostname remains the same even if the IP changes.
Alternatives to Port Forwarding
Port forwarding is not always the safest solution.
Many users now prefer:
VPN Servers
A VPN allows secure access to the entire home network.
Reverse Proxies
Can provide authentication and HTTPS protection.
Cloud Tunnels
Create outbound connections without exposing ports.
Mesh VPN Solutions
Allow direct device-to-device connections without router modifications.
These approaches often provide stronger security than traditional forwarding.
Troubleshooting Port Forwarding
Cannot Connect Externally
Verify:
- Correct public IP
- Correct internal IP
- Correct port number
- Router rule enabled
Service Not Running
Check:
sudo systemctl status service-name
or
sudo ss -tulnp
Firewall Blocking Traffic
Review firewall rules:
sudo ufw status
ISP Blocking Ports
Some ISPs block:
- Port 25
- Port 80
- Port 443
Try alternative external ports.
Double NAT Problems
If you have:
- ISP modem/router
- Separate Wi-Fi router
you may have two layers of NAT.
Port forwarding must be configured correctly through both devices or the modem placed into bridge mode.
Common Raspberry Pi Port Forwarding Examples
| Application | Internal Port |
|---|---|
| SSH | 22 |
| Web Server | 80 |
| HTTPS | 443 |
| Home Assistant | 8123 |
| Node-RED | 1880 |
| MQTT Broker | 1883 |
| VNC | 5900 |
| FTP | 21 |
| Plex | 32400 |
| WireGuard | 51820 |
These are among the most commonly forwarded services used on Raspberry Pi projects.
Final Thoughts
Setting up port forwarding for Raspberry Pi unlocks a wide range of remote-access possibilities. Whether you are administering servers, monitoring smart-home devices, hosting websites, or accessing files from anywhere, proper port forwarding allows external devices to reach your Pi through your home router.
The most important steps are assigning a static IP address, forwarding the correct ports, verifying that services are running, and implementing strong security measures. While port forwarding remains a powerful networking tool, it should always be combined with good security practices such as SSH keys, firewalls, updates, and intrusion prevention tools.
When configured correctly, port forwarding transforms a Raspberry Pi from a device that only works on your local network into a globally accessible server capable of supporting countless personal and professional projects.