🔧 FreeFlow Relay — Router Port Forwarding Guide

Find your router below and follow the steps to open port 8443 (TCP + UDP).

Quick start: Your relay needs TCP & UDP port 8443 forwarded to your computer.
  1. Enable UPnP on your router — easiest, fully automatic.
  2. No UPnP? Manually forward port 8443 (TCP+UDP) to your local IP.
  3. On CGNAT? No forwarding works — ask ISP for public IP or use a VPS.
TP-Link
Archer series, Deco mesh · 192.168.0.1 or tplinkwifi.net
▶

UPnP (automatic)

  1. Log in at 192.168.0.1 (admin / admin).
  2. Advanced → NAT Forwarding → UPnP.
  3. Toggle Enable UPnP ON → Save.

Manual port forwarding

  1. Advanced → NAT Forwarding → Port Forwarding.
  2. Click Add.
  3. Name: freeflow-relay, External Port: 8443, Internal Port: 8443, Protocol: TCP/UDP.
  4. Internal IP: your computer's local IP → Save.

Newer TP-Link models: you set your own password on first login. Deco mesh is managed via the Deco app — UPnP is on by default.

Asus
RT-AX, RT-AC, ROG Rapture · 192.168.1.1
▶

UPnP

  1. Log in at 192.168.1.1 (admin / admin).
  2. WAN → Internet Connection tab.
  3. Enable UPnP → set to Yes → Apply.

Manual port forwarding

  1. WAN → Virtual Server / Port Forwarding.
  2. Enable Port Forwarding.
  3. Profile: freeflow-relay, Port range: 8443, Local IP: your computer, Protocol: Both.
  4. Add → Apply.

Firmware: Asuswrt-Merlin has the same menu paths.

Netgear
Nighthawk (R-series), Orbi mesh · 192.168.1.1 or routerlogin.net
▶

UPnP

  1. Log in (admin / password).
  2. ADVANCED → Advanced Setup → UPnP.
  3. Check Turn UPnP On → Apply.

Manual port forwarding

  1. ADVANCED → Advanced Setup → Port Forwarding / Port Triggering.
  2. Add Custom Service.
  3. Service name: freeflow-relay, Service type: TCP/UDP, External/Local port: 8443, Local IP: your computer.
  4. Add → Apply.
Linksys
Velop mesh, WRT, EA series · 192.168.1.1
▶

UPnP

  1. Log in (admin / admin).
  2. Connectivity → Port Forwarding (or Smart Wi-Fi Tools → UPnP on older models).
  3. Check UPnP Enabled → OK / Apply.

Manual port forwarding

  1. Connectivity → Port Forwarding (or Security → Applications and Gaming).
  2. Add.
  3. Application: freeflow-relay, External/Local port: 8443, Protocol: Both, Device: your computer.
  4. OK.
D-Link
DIR, EXO, Covr mesh · 192.168.0.1
▶

UPnP

  1. Log in (admin, blank password or admin).
  2. Advanced → Advanced Network → UPnP.
  3. Check Enable UPnP → Save Settings.

Manual port forwarding

  1. Advanced → Port Forwarding (or Firewall → Port Forwarding).
  2. Add.
  3. Name: freeflow-relay, External/Internal port: 8443, Protocol: Both, Local IP: your computer.
  4. Save.
Fritz!Box (AVM)
All models · fritz.box or 192.168.178.1
▶

UPnP (Portfreigabe)

  1. Open fritz.box. Enter your PIN/password.
  2. Internet → Permit Access → Port Sharing tab.
  3. Check Allow device to share ports automatically → Apply.

Manual port forwarding

  1. Internet → Permit Access → Port Sharing tab.
  2. Add Port Sharing.
  3. Select "Other application", name: freeflow-relay, Protocol: TCP, External/Internal port: 8443, select your computer.
  4. OK. Repeat for UDP (second rule). Apply.

German firmware: "Portfreigabe" = Port Sharing.

Huawei
B-series (4G/5G), AX-series WiFi 6 · 192.168.3.1
▶

UPnP

  1. Log in (admin / admin, or check sticker).
  2. More Functions → Network Settings → UPnP.
  3. Toggle UPnP ON → Save.

Manual port forwarding

  1. More Functions → Network Settings → Port Mapping.
  2. Add.
  3. Name: freeflow-relay, Protocol: TCP+UDP, External/Internal port: 8443, Local IP: your computer.
  4. Save.
ZTE
ZXHN series, MC-series 4G/5G · 192.168.1.1
▶

UPnP

  1. Log in (admin / admin, or check sticker).
  2. Application → UPnP.
  3. Enable UPnP → Save.

Manual port forwarding

  1. Application → NAT → Port Forwarding (or Virtual Server).
  2. Add New.
  3. Name: freeflow-relay, External/Internal port: 8443, Protocol: ALL, Local IP: your computer.
  4. Save.
Tenda
AC, AX, Nova mesh · 192.168.0.1 or tendawifi.com
▶

UPnP

  1. Log in (admin, blank or user-set).
  2. Advanced → UPnP Settings.
  3. Toggle UPnP ON → OK.

Manual port forwarding

  1. Advanced → Virtual Server (or Port Forwarding).
  2. Add.
  3. Name: freeflow-relay, Port: 8443, Protocol: ALL, Local IP: your computer.
  4. OK.
Xiaomi
Mi Router series · 192.168.31.1 or miwifi.com
▶

UPnP

  1. Log in (admin / admin).
  2. Advanced → UPnP Settings.
  3. Toggle UPnP ON → Save.

Manual port forwarding

  1. Advanced → Port Forwarding.
  2. Add.
  3. Name: freeflow-relay, Protocol: TCP+UDP, Port: 8443, Local IP: your computer.
  4. Save.

Also manageable via the Mi Home app on Android/iOS.

Google Nest WiFi / Google WiFi
Managed via Google Home app · 192.168.86.1
▶

No web admin interface. Use the Google Home app on your phone.

  1. Open the Google Home app.
  2. Tap Wi-Fi → Settings → Advanced networking.
  3. Tap Port management → Add port management.
  4. Name: freeflow-relay, Protocol: TCP and UDP, Port: 8443, Device: your relay computer.
  5. Tap Save.

No UPnP toggle — port forwarding is manual-only via the app.

Amazon eero
Managed via eero app · 192.168.4.1
▶

No web admin interface. Use the eero app.

  1. Open the eero app.
  2. Settings (gear icon) → Network Settings → Port Forwarding.
  3. Add Port Forwarding.
  4. Name: freeflow-relay, Protocol: TCP + UDP, Port: 8443, Device: your relay computer.
  5. Tap Add.
Apple AirPort / Time Capsule
NAT-PMP by default · 10.0.1.1
▶

Apple AirPort uses NAT-PMP by default — the FreeFlow relay auto-detects it, no config needed.

Manual port mapping (if needed)

  1. Open AirPort Utility on macOS (or iOS).
  2. Select your AirPort → Edit → Port Settings tab.
  3. Click +.
  4. Description: freeflow-relay, Public/Private port: 8443, Protocol: TCP/UDP (two entries), Private IP: your computer.
  5. Done → Update.

NAT-PMP is enabled by default on all AirPort models.

Ubiquiti UniFi
UniFi Network Controller · 192.168.1.1:8443
▶

UniFi does not have UPnP on most firmware — use manual port forwarding.

  1. Log in to the UniFi Network Controller or app.
  2. Settings → Routing & Firewall → Port Forwarding.
  3. Add Rule.
  4. Name: freeflow-relay, Protocol: TCP + UDP, WAN port: 8443, LAN port: 8443, LAN IP: your computer.
  5. Save.
OpenWrt
LuCI web UI · 192.168.1.1
▶

UPnP / NAT-PMP / PCP

  1. Log in to LuCI (root, your password).
  2. Services → UPnP & NAT-PMP.
  3. Check Enable UPnP and Enable NAT-PMP.
  4. Save & Apply.

Manual port forwarding

  1. Network → Firewall → Port Forwards.
  2. Add.
  3. Name: freeflow-relay, Protocol: TCP+UDP, External port: 8443, Internal IP: your computer, Internal port: 8443.
  4. Save & Apply.

Via SSH (no LuCI): opkg install luci-app-upnp miniupnpd && /etc/init.d/miniupnpd enable && /etc/init.d/miniupnpd start

pfSense
HTTPS web UI · 192.168.1.1
▶

UPnP / NAT-PMP / PCP

  1. Log in (admin / pfsense).
  2. Services → UPnP & NAT-PMP.
  3. Check Enable UPnP. Set Network(s) to your LAN subnet (e.g. 192.168.1.0/24).
  4. Save → restart the service.

Manual port forwarding

  1. Firewall → NAT → Port Forward tab.
  2. Add.
  3. Interface: WAN, Protocol: TCP/UDP, Destination port: 8443, Redirect target IP: your computer, Redirect target port: 8443.
  4. Description: freeflow-relay. Save → Apply Changes.
OPNsense
HTTPS web UI · 192.168.1.1
▶

UPnP / NAT-PMP

  1. Log in (root / opnsense).
  2. Services → Os-UPnP.
  3. Check Enable UPnP/NAT-PMP. Set Allowed networks to your LAN.
  4. Save → Apply.

Manual port forwarding

  1. Firewall → NAT → Port Forward.
  2. Click +.
  3. Interface: WAN, Protocol: TCP/UDP, Destination port: 8443, Redirect IP: your computer, Redirect port: 8443.
  4. Save → Apply.
MikroTik
WinBox app · 192.168.88.1
▶

UPnP

  1. Log in (admin, blank password) or via WinBox.
  2. IP → UPnP.
  3. In Interfaces tab, click +. Add your WAN as "external" and LAN as "internal".
  4. Enable: check Show Dummy Rule and Allow Disable/Enable. Apply → OK.

Manual port forwarding (dst-nat)

  1. IP → Firewall → NAT tab. Click +.
  2. Chain: dstnat, Protocol: tcp, Dst. Port: 8443, Action: dst-nat, To Addresses: your computer's IP, To Ports: 8443. Apply.
  3. Add a second rule for UDP (change Protocol to udp).
Belkin
All models · 192.168.2.1
▶

UPnP

  1. Log in (no password by default).
  2. Firewall → UPnP Settings.
  3. Check Allow UPnP Port Mapping → Apply Settings.

Manual port forwarding

  1. Firewall → Virtual Servers (or Port Forwarding).
  2. Add.
  3. Name: freeflow-relay, Protocol: TCP+UDP, Inbound/Outbound port: 8443, IP: your computer.
  4. Apply Settings.
ISP Gateways (Arris, Technicolor, Sagemcom)
ISP-supplied · various IPs
▶

Arris/SBG: 192.168.0.1 (admin/password) → Gateway → Port Forwarding → Add rule for port 8443, protocol Both.

Technicolor: 192.168.1.254 (admin/admin) → Advanced → NAT/Gaming → Add Port Mapping for 8443.

Sagemcom: 192.168.1.1 (admin/admin) → Advanced Settings → Port Forwarding → Add rule for 8443.

Locked by ISP? Contact your ISP to enable port forwarding, or put the gateway in bridge mode and use your own router behind it.

✅ Verify Your Port Is Open

Method 1: Visit canyouseeme.org and check port 8443.

Method 2: Use your phone on mobile data (not WiFi) and try to connect. Or ask someone outside your network.

Method 3: Check the relay log for:

Relay is LIVE — accepting connections
  Public:    203.0.113.7:8443  [UPnP mapped → 203.0.113.7:8443]

UPnP mapped NAT-PMP/PCP mapped Direct (public IP / VPS) = good ✓
Warning about forwarding = not reachable ✗

Important: Testing from inside your own WiFi/LAN usually fails even when forwarding is correct. Most routers don't support NAT hairpinning. Always test from outside your network.

🔧 Troubleshooting

SymptomCauseFix
Can't access router adminWrong IPCheck default gateway with ipconfig
Default password failsChangedFactory reset (hold reset 10s)
UPnP on but unreachableCGNATCompare router WAN IP vs public IP
Port checker says closedNot forwarded / firewallAdd both TCP and UDP rules for 8443
Only TCP works, QUIC failsMissing UDP ruleAdd a UDP rule for port 8443
Relay works then stopsDHCP changed your IPSet a static IP or DHCP reservation

⚠️ CGNAT — When Nothing Works

If your ISP uses Carrier-Grade NAT, no port forwarding will work. Your router's WAN IP is a private address shared with many customers.

Signs of CGNAT:
  • Router WAN IP starts with 100.64.–100.127. (RFC 6598).
  • Router WAN IP ≠ your public IP from whatismyip.com.
  • UPnP "succeeds" but port checkers say closed.
Solutions:
  1. Ask your ISP for a public/static IP (sometimes free).
  2. Run on a VPS — any server with a public IP ($3–5/month).
  3. Bridge mode — put ISP gateway in bridge mode, use your own router. Only works if ISP assigns a public IP.
Deprecation: Reverse tunnel for CGNAT relays was deprecated 2026-06-23. The [nat] tunnel_fallback and tunnel_relay settings are no longer functional.

📌 Set a Static IP

Port forwarding requires your computer's local IP to stay the same.