Port forwarding on eero and Google Nest Wifi

The two popular app-only mesh systems. Both can do it; neither has a web page to do it from.

This opens a door into your own network and you are responsible for what comes through it. Read the warnings first if you have not.

Before you start, it is worth knowing that from firmware 1.2.2 the board can ask your router to set this up by itself. If your router answers, there is nothing on this page for you to do. Let the board ask your router.

eero

On eero the forward lives inside a device's address reservation, so the reservation comes first and there is no separate forwarding screen.

Open the eero app and tap Settings, bottom right.
Tap Advanced networking.
Tap Reservations & port forwarding.
Add a reservation under IPv4 Reservations & Port Forwards.
Pick the board from the connected devices, or add it, and set its nickname, MAC address and address.
Tap Open a port, then Save.
Enter 6400, give it a nickname, choose TCP.
Tap Save, top right.

eero does not show separate internal and external port boxes, so a 6400 to 6400 forward is one entry. To remove it, return to the same screen, tap the board, tap the port, tap Delete port forward.

Older app builds called that menu Network settings rather than Advanced networking, and eero's own pages are inconsistent about it. Trust the label on your screen.

Subscription

Port forwarding and reservations are free. Of the advanced settings only Dynamic DNS needs eero Plus. eero's article never mentions a subscription in the forwarding flow, and its feature list tags only Dynamic DNS, which is the basis for saying so.

Bridge mode

An eero in bridge mode cannot forward ports at all. eero lists reservations and port forwarding among the features lost. Bridge the ISP box instead, never the eero.

Once a forward exists, loopback works on eeroOS 3.3.0 and later, so you can test your public address from inside the house.

Google Nest Wifi and Google Wifi

Reserve the board's address first. A forward points at an address, and Google's reservation screen is what stops that address changing under the rule.

Reserve the address

Google Home app > Home > Wifi > Network settings > Advanced Networking > DHCP IP reservations > Add IP reservations, pick the board, type the address, Save. The board may need to reconnect before it takes it.

Add the rule

Open the Google Home app.
Tap Home > Wifi > Settings > Advanced Networking.
Tap Port management > Add.
Choose the IPv4 tab.
Select the board.
Internal port 6400, external port 6400. Ranges are allowed but internal and external ranges must match; only single ports may differ.
Choose TCP.
Save.

Google's own two articles disagree about step 2, one saying Settings and one Network settings. Both reach Advanced Networking.

Old app, new app, and the hardware

The Google Wifi app is read-only now. Changes happen in the Google Home app, and migrating is not reversible.
Nest Wifi Pro is set up in the Google Home app and will not mesh with Nest Wifi or Google Wifi points.
UPnP is on by default, so plenty of devices open their own ports without any of this. That is worth knowing whether or not you wanted it.
Loopback works, so a forwarded service is reachable by public address from inside.

When it does not work

Double NAT and CGNAT stop any router's forward, and both are explained on the main port forwarding page. What a mesh adds:

Double NAT. The WAN address is in the app. If it is private, bridge the ISP box, not the mesh: eero loses forwarding entirely in bridge mode, and a Google mesh with more than one unit cannot be bridged at all.
IPv4 and IPv6 are separate. An IPv4 forward does nothing for IPv6. On eero that is a rule under IPv6 Firewall Rules; on Google it is the IPv6 tab, and Google calls it port opening rather than forwarding because there is no translation: the port is the same at both ends and the board is reached at its own global address, which can change when the ISP's prefix changes.