Port forwarding on an ASUS router
RT-AX and RT-AC models on ASUSWRT, firmware 3.0.0.4.384.40000 or later.
This opens a door into your own network and you are responsible for what comes through it. Read the warnings first if you have not.
Before you start, it is worth knowing that from firmware 1.2.2 the board can ask your router to set this up by itself. If your router answers, there is nothing on this page for you to do. Let the board ask your router.
Log in
Connect by Ethernet or Wi-Fi, then open http://www.asusrouter.com or the router's address. ASUS's own example is 192.168.50.1.
Some models use admin / admin; others print the defaults on a label on the back or bottom; a router on first boot, or after a reset, makes you create the login instead.
If the password is unknown there is no recovery. ASUS says so plainly: the only way back in is a factory reset, holding RESET for 5 to 10 seconds until the power light flashes. That erases everything, including your internet settings.
Give the board a fixed address
Advanced Settings > LAN > DHCP Server:
- Note the IP pool range, for example
192.168.50.2to192.168.50.254. - Set Enable Manual Assignment to Yes.
- Under Manually Assigned IP around the DHCP list, pick the board from the MAC dropdown, or type its MAC in
12:34:56:AA:BC:DEform. - Enter an address inside the pool, for example
192.168.50.75. DNS is optional. - Click the
+, then Apply. - Reconnect the board so it takes the new lease.
Add the rule
Advanced Settings > WAN > Virtual Server / Port Forwarding:
- Switch Enable Port Forwarding to ON. It is off by default, and this is the step people miss.
- Click Add profile.
- Service Name:
bbs - Protocol:
TCP - External Port:
6400 - Internal IP Address: the address you reserved
- Internal Port:
6400 - Source IP: leave blank, or set one address to restrict who may connect.
- OK, then Apply.
ASUS notes that Internal Port may be left blank, in which case traffic arrives on the same port; that External Port accepts ranges with a colon (300:500), lists with commas, or both; and that one external port can serve only one device, so conflicting rules will not run.
Service Name is not documented as mandatory, but some builds refuse to save without it and reusing a name can overwrite an existing rule. Fill it in with something unique. That is field experience rather than ASUS documentation.
The ASUS Router app and AiMesh
ASUS documents in-app port forwarding only for the older Lyra app (Settings > Port Forwarding > +). There is no ASUS page giving the path in the current ASUS Router app, so the web interface is the authoritative route.
On AiMesh, make every change on the AiMesh router, the one connected to the modem. ASUS states that router settings can only be made there, not on nodes. It makes no difference which unit the board is associated with.
When it does not work
Double NAT and CGNAT stop any router's forward, and both are explained on the main port forwarding page. What ASUS adds:
- Double NAT. ASUS states that port forwarding needs a public WAN address and will not work properly behind another router. Put the ISP device into bridge or IP passthrough mode, or forward the port on both.
- CGNAT. ASUS names the range explicitly:
100.64.0.0to100.127.255.255. - IPv6. ASUS states port forwarding is not supported for IPv6 and that there are no plans to support it. Inbound IPv6 is the IPv6 Firewall, switched on and given its own rules under Firewall > General.
- Firmware. Anything before 3.0.0.4.384.40000 uses a different page layout and a separate ASUS document. Some older models never got the newer one.
- The board itself. The rule only moves packets. The board has to be listening, which you can confirm from your own network first.