Port forwarding on an Xfinity gateway
A rented Xfinity gateway, through the Xfinity app.
This opens a door into your own network and you are responsible for what comes through it. Read the warnings first if you have not.
Before you start, it is worth knowing that from firmware 1.2.2 the board can ask your router to set this up by itself. If your router answers, there is nothing on this page for you to do. Let the board ask your router.
On a rented Xfinity gateway, port forwarding lives in the mobile app, not in the gateway's own web page. Comcast states that customers with Xfinity Gateways can only set up and adjust port forwarding using the Xfinity app.
Steps in the app
- Open the Xfinity app and sign in with a Primary, Manager or Member ID.
- Select WiFi.
- Select View WiFi equipment.
- Select Advanced Settings.
- Select Port Forwarding.
- Select Add Port Forward, then Continue.
- Pick the board from the device list. It must be connected, on IPv4, using DHCP.
- Pick a preset, or select Manual Setup to enter ports and protocol.
- Select Next to save.
For a board: choose Manual Setup, external and internal port both 6400, protocol TCP. Comcast's article confirms Manual Setup takes port numbers and settings but does not print the field labels, so the exact wording on screen is not quoted here.
The web route, and the local page
Comcast's current documentation describes port forwarding in the app and nowhere else.
The local Admin Tool at http://10.0.0.1 still exists, but it has to be switched on from the app first, and Comcast does not document port forwarding in it. To switch it on: WiFi > View WiFi equipment > Advanced Settings > Admin Tool online access > Allow Admin Tool access > Save. The username is admin, and the password is the one you create when you switch it on.
Reserving an address
A forward has to point at an address that does not move. The app binds the rule to the device you picked rather than showing a reservation screen, and there is no official Comcast article documenting a reserved-IP control in the app, so treat any menu path you find for it as unverified. The route people commonly use is the Admin Tool: Connected Devices > Devices > Edit > Reserved IP. That comes from Comcast's forums, not its documentation.
One caveat from the official article: if the device uses MAC address randomisation the rule will break, and a forward whose device has gone cannot be edited, only deleted and recreated. Turn randomisation off for the board.
Using your own router instead
Put the gateway in Bridge Mode: Admin Tool at http://10.0.0.1 > Gateway > At a Glance > Enable next to Bridge Mode. Routing stops and the modem function stays. You lose the gateway's Wi-Fi, xFi network management, Wi-Fi extenders and Xfinity CyberSecure, and only one device may connect by Ethernet. Your own router then does the forwarding.
When it does not work
- Xfinity CyberSecure, previously Advanced Security. When it sees something aimed at a device with port forwarding, DMZ or UPnP ports open, it blocks all traffic from that device's open ports. Comcast recommends leaving it on and using Allow Access on the device; turning it off is the other way out. Worth checking first when the rule is correct and the traffic is still dropped.
- Double NAT. Your own router behind a gateway that is still routing gives two layers. The gateway's Bridge Mode is the fix. Double NAT and CGNAT on any router are explained on the main port forwarding page.
- IPv4 only. The app's port forwarding is IPv4. Xfinity carries both, so a board reachable over IPv6 may still be unreachable over IPv4.