Port Forwarding: Whose Job Is It, Really?

A simple explanation for business owners and IT teams

◆ Port Forwarding on a Router: Why It’s Your ISP’s Job, Not Your Network’s

If you’ve ever tried to access your office CCTV, biometric attendance device, or server from outside — and it just won’t connect through your router — the usual reflex is to blame the router or the internal network. In almost every case, that’s the wrong place to look.

Port forwarding is not something any router can create on its own. It depends on what your Internet Service Provider (ISP) allows and delivers at the WAN connection. This article explains why, in plain language, and ties every technical point specifically to how routing works, so both business owners and their IT teams can ask the right questions before troubleshooting the wrong thing.

◆ Port Forwarding In Simple Terms

Think of your internet connection as one large office building with a single reception desk. Every request that arrives from outside — a phone call, a courier, a visitor — reaches that reception desk first. Port forwarding is the instruction you give the receptionist:

“When someone asks for the biometric device, send them to Room 12. When someone asks for the CCTV, send them to Room 7.”

In networking terms: an external device on the internet wants to reach a specific device inside your office — a camera, a biometric machine, a server. A router receives that incoming request on its WAN interface and forwards it to the correct internal device (based on a port-forward/NAT rule configured under Settings → Firewall → Port-Forward/NAT in the Route10 management interface).

◆ The Part Everyone Misses: A Router’s WAN Needs a Public IP Address First

For port forwarding to work at all, a router’s WAN interface (On the Alta Labs Route10 this is Port 1 by default, or WAN2 on the SFP+ port if you use dual-WAN) must be assigned a public, internet-routable IP address.

A router lets you set the WAN connection as Static IP, DHCP/Automatic, or PPPoE — but whichever mode you choose, the address the ISP hands over must actually be public, not a private or carrier-shared one.

If the router’s WAN shows a private address (something like 192.168.x.x or 100.64.x.x), it means the router is sitting behind another device — usually the ISP’s own modem or ONT — and that device is the one actually holding the public IP.

In that situation, the router cannot receive incoming internet requests at all, no matter how correctly its port-forward rules are configured. The fix is to have the ISP’s modem/ONT set to Bridge Mode, so the public IP passes straight through to the router’s WAN interface.

Once a router holds the public IP, it can receive requests from the internet and forward them to the right internal device.

Example: To access an office biometric device remotely, a router’s WAN interface needs a public IP, and a port-forward rule on the router sends the relevant port to the biometric device’s internal IP address. That’s what lets an authorized user reach it from outside the network.

This explanation of the public IP / bridge mode mechanics comes from Rohita, Mass Infotech – Alta India Support, based on her hands-on experience configuring router deployments — credit to her for the technical clarity here.

◆ A Technical Note for the IT Team

If you configure a DMZ or a full port-range forward rule on a router to pass all traffic to one internal device (common for third-party firewalls), be aware this takes precedence over services running on the router itself, including its built-in VPN.

If you still need the router services reachable from the internet, leave gaps around the ports they use instead of forwarding the entire range — for example, forwarding 1–499 and 501–65535 to preserve port 500 for IPsec VPN.

This is a router configuration detail, not a limitation of your ISP connection.

◆ Why This Is an ISP Decision, Not an Equipment Decision

Every ISP offers two broad categories of internet connection:

• Consumer Grade: Economical, but built for basic home and educational use. Static IPs and port forwarding are usually not available, at any price.

• Enterprise Grade: More expensive, but includes (by default, or on request) static IP addresses and the ability to configure port forwarding.

This distinction has nothing to do with the router or any other equipment on your side of the connection.

Routers such as the Route10’s built-in firewall, VPN server, IDS/IPS, and dual-WAN failover/load-balancing are all functions it performs once it already has a working internet connection. They manage what happens after traffic reaches your network boundary.

None of them can create a public IP where the ISP has not provided one, and the same is true for any access point or switch sitting behind the router, regardless of brand, at any price point.

A simple rule of thumb: if your ISP’s modem/router/ONT allows a public IP and port forwarding through to the router, everything behind it — Alta Labs or otherwise — will work. If the ISP doesn’t allow it, no equipment behind the router will fix it.

◆ When You Actually Need Enterprise-Grade Internet

You need a static or dedicated public IP and ISP-side port forwarding if you plan to run any of the following from outside your office, through the router:

• CCTV viewed remotely • Biometric attendance or access-control devices • Centralized storage or servers accessed from outside • Networked printers accessed from outside • Point-to-point links between office, factory, home, or another branch • Cloud backup or storage • A router’s (such as Alta Labs Route10) native VPN server, or a third-party VPN behind it • Any automation device that needs to be reachable from outside the office

If any of these apply to your business — now, or within the next 3–5 years — this should be part of the conversation when you choose an ISP plan, not an afterthought when something stops working.

◆ A Practical Note From the Field

While working across ISPs in Mumbai, local cable/broadband providers have often turned out to be easier to work with than large corporate ISPs — more open to letting you choose your router as your own termination device, and more willing to provide genuine enterprise-grade service.

Large corporate ISPs, simply because of the scale of their operations, often can’t offer the same flexibility or customization to an individual client, even at enterprise pricing.

This observation is based on direct field experience and will vary by location and provider. Confirm current policies with any ISP before committing.

◆ What to Ask Your ISP, Before You Need It

• Is this a consumer-grade or enterprise-grade connection?

• Does this plan include a static, dedicated public IP? If not, can one be added?, and at what cost?

• Will you allow port forwarding through to a customer-owned router such as Route10?

• Is this a dedicated public IP, or a shared IP behind CGNAT (Carrier-Grade NAT)? Large Indian ISPs commonly place residential and even some business plans behind CGNAT by default — this blocks port forwarding regardless of the router’s configuration. Policies vary and change; confirm directly and in writing rather than assuming.

• If we bring our own router, can your modem/ONT be set to Bridge Mode so the router receives the public IP directly?

◆ A Note on the Legal Side

There is no telecom regulation in India (under TRAI) that entitles a customer to a static or public IP address, or that requires an ISP to permit port forwarding.

These are commercial features governed entirely by the ISP’s own tariff plan and service agreement, not by a regulatory guarantee.

If remote access to CCTV, biometric devices, or servers is business-critical, get the static IP and port-forwarding commitment written into your service agreement or order form with the ISP — a verbal assurance from a sales representative is not enforceable the same way a documented commercial term is.

◆ The Bottom Line

Port forwarding through a router fails when the ISP hasn’t provided a public IP or hasn’t allowed the feature through to your router, not because of the router’s configuration, brand, or any equipment behind it.

Before troubleshooting the network, confirm the one thing that actually controls remote access: what your ISP’s edge device is allowing onto the router’s WAN.

Article created with input from:

Vihang Vasa — Founder, Photonics Enterprise; Alta Product Specialist, Mumbai India

Mass Infonet — National Distributor, IT Segment, Mumbai, India

Sources referenced for technical fact-checking: Alta Labs Port Forwarding documentation (help.alta.inc), Route10 product datasheet (alta.inc/route10), Alta Labs community forum threads on Route10 WAN/port-forwarding setup.

◆ Your Alta Labs Specialist in India

Technology is only as good as the team that deploys it. Photonics Enterprise is a certified Alta Labs specialist based in Mumbai, providing professional site surveys, RF planning, and network design tailored to your premises. Their offer rapid on-site support, in-house IT team training, and ongoing post-sale monitoring — with a direct escalation channel to Alta Labs global engineering when needed.

Alta Labs products are available in ready stock through Photonics Enterprise, allowing immediate deployment without the usual procurement delays.

Part of the Photonics Enterprise culture is to share knowledge openly with interested and like-minded people, to build new relationships, and to evolve together. If anything in this guide raised a question, we would be glad to talk it through.

To arrange a demonstration or a conversation, please get in touch with Photonics Enterprise.

Vihang VASA

Founder, Photonics Enterprise — Mumbai

+91 98200 29063  ·  info@photonicsenterprise.com