Local service works, port forwarding rule exists, but remote access cannot connect. A partial failure matters: one capability still functions, while a closely related step does not. This guide focuses on isolating that difference in wi-fi and routers, not on indiscriminate resets. Use the known-good behavior as your control, change one variable at a time, and retest the original scenario after each intervention.
Quick decision path
Baseline test: Compare WAN IPv4 reported by router with the public address. Record the current device model, OS or firmware version, and whether this occurs with one file, account, network or source. A reproducible contrast is more informative than a vague message such as “not working.” If the control fails too, stop treating this as a feature-specific problem and investigate the shared dependency first.
What the evidence means
| Hypothesis | Evidence worth checking | Next decision |
|---|---|---|
| ISP CGNAT prevents inbound IPv4 | Compare network association, address and gateway information on the affected device with a known-working device. | If the control still works, focus on the affected path rather than resetting the whole device. |
| Forwarding targets wrong LAN IP | Repeat the same action under a controlled alternate state and record the exact difference in outcome. | If this condition is not present, leave the associated setting unchanged. |
| Host firewall rejects inbound traffic | Repeat the same action under a controlled alternate state and record the exact difference in outcome. | Only escalate to this branch if the simpler comparison did not explain the failure. |
Correction without unnecessary resets
Route A — Correct the observable mismatch
Ask ISP about public IPv4 or use a secure authenticated tunnel instead of stacking forwards. Start only after capturing the baseline. When the recommended control is not present on your model, look for its supported equivalent in the product documentation rather than following screenshots from another version.
Return immediately to the failing task and check whether the outcome changed. If it did, preserve the working setting and avoid piling on additional changes. If it did not, undo the change where appropriate before moving to deeper checks.
Protect your setup: Avoid forwarding admin dashboards to the public internet. Keep the current SSID, encryption, DNS and router configuration documented. Use a trusted network and never weaken firewall or WPA settings just to make a test pass.
Advanced isolation and compatibility
Route B — Test the underlying dependency
Test service from external network and validate host listener before changing NAT rules. This advanced comparison is worthwhile only if the simple check did not resolve the problem. The first two possibilities to separate are ISP CGNAT prevents inbound IPv4 and forwarding targets wrong LAN IP. Do not interpret their presence as proof of a diagnosis; a compatible device and a partially failed service may coexist.
Route C — Handle a limitation or persistent fault
A third explanation is host firewall rejects inbound traffic. Check whether the feature requires particular hardware, account privileges, region settings or source formats. When a feature is unsupported, there may be no legitimate settings-only fix; use the vendor-documented alternative rather than an unsafe workaround.
Step-by-Step Troubleshooting
Follow the Beginner steps first. Advanced steps are for isolating hardware, application or network-specific causes after a safe baseline test.
Confirm the boundary
Local service works, port forwarding rule exists, but remote access cannot connect. Do not assume this is a complete outage. Compare WAN IPv4 reported by router with the public address. Keep the account and connections unchanged between attempts.
Capture a useful baseline
Write down the affected model, software version, active input and when this started. Compare WAN IPv4 reported by router with the public address. A working comparison tells you which part of the chain is still healthy.
Use the least disruptive correction
Ask ISP about public IPv4 or use a secure authenticated tunnel instead of stacking forwards. Apply one supported change at a time; stop if your model uses a different setting or does not advertise the feature.
Confirm the expected outcome
Authorized remote clients reach the intended service without exposing unrelated ports. Try the original failing action again, not an unrelated easier test; retain the old setting until you know the change helped.
Test the first dependency
Investigate whether ISP CGNAT prevents inbound IPv4. Specifically, compare network association, address and gateway information on the affected device with a known-working device. Compare the result with the working baseline from the beginner route.
Separate another possible cause
Assess whether forwarding targets wrong LAN IP. For this branch, repeat the same action under a controlled alternate state and record the exact difference in outcome. Do not change that configuration unless the evidence supports it.
Inspect the third branch
Test service from external network and validate host listener before changing NAT rules. Also consider host firewall rejects inbound traffic. Record the exact point of failure and check product-specific support limits.
Validate and plan a rollback
Authorized remote clients reach the intended service without exposing unrelated ports. Avoid forwarding admin dashboards to the public internet. If the last change made matters worse, restore it and request supported assistance with a redacted troubleshooting summary.
Verify the result
Success looks like this: Authorized remote clients reach the intended service without exposing unrelated ports. Run this check on the same device and account that originally failed. A different device passing is useful as a comparison, but it does not prove the original issue is fixed.
What to check if it still fails
Before contacting support, collect the exact model and version, the outcome of the baseline test, and whether the controlled correction changed anything. Keep passwords, private media, account identifiers, serial numbers and network keys out of screenshots or shared logs. Avoid forwarding admin dashboards to the public internet.
Solution Checklist
When to seek model-specific support
If the supported correction does not work and host firewall rejects inbound traffic remains plausible, stop before a destructive action. Provide the vendor with the baseline from this guide and ask whether the exact hardware and software combination supports the requested behavior.