Port Forwarding vs Port Triggering explained

Play Now

mir2pion

TL;DR
Veteran
Feb 21, 2013
3,591
2
679
265
I have a PC hosting mir3d behind a newly installed modem/router that doesn't have port forwarding in its setup webpage. Instead you are supposed to download mobile app, log into your ISP account and set it up from there. But I can't even log into that webpage to begin with, and tons of pple who managed to log in complain that it doesn't work...

So I looked seriously at port triggering, which is included in the local webpage modem setup, with the aim of actually using it.
I searched on the internet and found many places trying to explain what this port triggering is, but nobody actually explained the first thing what it is about, what it is and what it is not. Information on this subject is either incomplete, in that the explaining ends up to be about port forwarding only with a sideline mention of port triggering, or what is said about it is outright false or a nonsense, like that it is good for gaming.

To let the cat out of the bag, port triggering is NOT a replacement for port forwarding in any sense, whereby you open ports full time to allow WAN internet traffic into your LAN, like if you host mir server for pple to connect to it from remote places.

Port Triggering is meant to allow traffic from your LAN, via ports which are closed, to WAN. If it is a traffic to contact a website out there on the internet, the router will direct the returning replies (only) to the LAN computer that initially sent that traffic request to that website (ie, its LAN IP doesn't need to to be specified in the port triggering table, as it needs to be when you set up port forwarding).

As I understand it, outgoing ports on the router are normally, in its default setting, opened. It is only if you intentionally close the outgoing ports (for extra security reasons) that you then need to open the needed ones by using port triggering to open them on demand from within LAN.
By default, router comes with all incoming ports closed, except those which are commonly used, most common being port 80 for http protocol, or port 403 for https, more secure protocol that most websites these days will use.

Don't confuse this with windows firewall that resides on the PC, which by default keeps most outgoing ports closed (again, the most common one are left open). This is why programs when started for the first time pop up firewall message asking if you want to allow access to the LAN (and to internet) to open its firewall outgoing ports (the router ports will be opened by default, so once you allow it from your computer, it has internet access automatically (again assuming default router setting and the router is consumer variety).

So, the bottom line is, port triggering cannot be used to let the traffic from remote mir clients into your home network to connect to your mir server. It only works for the outbound traffic from your LAN, not for the incoming one, like the traffic you didn't request.
 
Last edited:
  • Like
Reactions: trancefied

Jev

Mir 4 Incoming!
VIP
May 16, 2017
5,026
34
3,236
330
Worthing, West Sussex
I have a PC hosting mir3d behind a newly installed modem/router that doesn't have port forwarding in its setup webpage. Instead you are supposed to download mobile app, log into your ISP account and set it up from there. But I can't even log into that webpage to begin with, and tons of pple who managed to log in complain that it doesn't work...

So I looked seriously at port triggering, which is included in the local webpage modem setup, with the aim of actually using it.
I searched on the internet and found many places trying to explain what this port triggering is, but nobody actually explained the first thing what it is about, what it is and what it is not. Information on this subject is either incomplete, in that the explaining ends up to be about port forwarding only with a sideline mention of port triggering, or what is said about it is outright false.

To let the cat out of the bag, port triggering is NOT a replacement for port forwarding in any sense, whereby you open ports full time to allow WAN internet traffic into your LAN, like if you host mir server for pple to connect to it from remote places.

Port Triggering is meant to allow traffic from your LAN, via ports which are closed, to WAN. If it is a traffic to contact a website out there on the internet, the router will direct the returning replies (only) to the LAN computer that initially sent that traffic request to that website (ie, its LAN IP doesn't need to to be specified in the port triggering table, as it needs to be when you set up port forwarding).

As I understand it, outgoing ports on the router are normally, in its default setting, opened. It is only if you intentionally close the outgoing ports (for extra security reasons) that you then need to open the needed ones by using port triggering to open them on demand from within LAN.
By default, router closes all incoming ports except those commonly used, most common being port 80 for http protocol, or port 403 for https, more secure protocol that most websites these days will use.

So, the bottom line is, port triggering cannot be used to let the traffic from remote mir clients into your home network to connect to your mir server. It only works for the outbound traffic from your LAN, not for the incoming one, like the traffic you didn't request.
Thanks sky

Had this issue a few days ago when trying to set up crystal for a fellow community member.
 

mir2pion

TL;DR
Veteran
Feb 21, 2013
3,591
2
679
265
I recall it now but that was like weeks or months ago, it was the case when he put his computer in DMZ, exposing it to the internet directly, and was also messing with port triggering.

Was he also missing port forwarding in his router setting? How did it end up?
 

Jev

Mir 4 Incoming!
VIP
May 16, 2017
5,026
34
3,236
330
Worthing, West Sussex
I recall it now but that was like weeks or months ago, it was the case when he put his computer in DMZ, exposing it to the internet directly, and was also messing with port triggering.

Was he also missing port forwarding in his router setting? How did it end up?
Yea port forwarding options were replaced with a “Please use the Sky Go app to port forward”
 

mir2pion

TL;DR
Veteran
Feb 21, 2013
3,591
2
679
265
I suspect that port forwarding done in the app open ports on the ISP servers, not on your router. The router is, most likely, hard set to accept traffic on all ports. Makes me wonder if this is going to be the future.

Might be done this way so the ISP can close the ports if someone downloads through them too much, or the government bans some program that works through certain ports and such like. Some programs allow you change ports they use but if you have to 'ask' ISP to open them (asking via that app), they may not let you open them using that app...
 

MentaL

Jev For Admín!
VIP
Mar 3, 2004
3,843
552
385
Cardiff
If your ISP has put you behind a CGNat, good luck getting around port forwarding and triggering directly.
 
  • Like
Reactions: Martyn

Jev

Mir 4 Incoming!
VIP
May 16, 2017
5,026
34
3,236
330
Worthing, West Sussex
Had another forum member approch me today, They are unable to patch a private mir 2 server's client.

I would like to thank Sky again but this time for blocking Ionos ISP, no firewall/router changes can bypass this either.

I think it's a pretty safe comment to advise anyone wanting to release a Mir private server to avoid Sky Broadband.

PS: DNS changing did fk all also.
 

Alecs

SPQR
VIP
Jan 10, 2009
3,519
3
1,415
360
Europa
If your ISP has put you behind a CGNat, good luck getting around port forwarding and triggering directly.

Some will give you a unique IP if you ask them, at least here in Spain. If not, you can use things like Tailscale or Cloudflare Tunnels. A pain in the ass but it can be done.

We need IPv6 working ASAP.
 

Jev

Mir 4 Incoming!
VIP
May 16, 2017
5,026
34
3,236
330
Worthing, West Sussex
Had another forum member approch me today, They are unable to patch a private mir 2 server's client.

I would like to thank Sky again but this time for blocking Ionos ISP, no firewall/router changes can bypass this either.

I think it's a pretty safe comment to advise anyone wanting to release a Mir private server to avoid Sky Broadband.

PS: DNS changing did fk all also.
Scrap the IONOS part, turns out the last few hours they’ve been randomly blocking connections.
 

Martyn

Smir.co.uk
Staff member
Administrator
Mar 24, 2003
4,094
4
1,005
410
Kent - UK
If your ISP has put you behind a CGNat, good luck getting around port forwarding and triggering directly.

Some will give you a unique IP if you ask them, at least here in Spain. If not, you can use things like Tailscale or Cloudflare Tunnels. A pain in the ass but it can be done.

We need IPv6 working ASAP.
gnat is a nightmare, and most charge for an IP -.-
 

blazee

Dedicated Member
Dedicated Member
Mar 3, 2012
216
91
55
I read the title and thought incoming atleast 4 paragraphs, but you smashed it out the water with 7!?

No but honestly good info