How do you set up port mapping on Tenda routers? On a business trip, I had to connect my remote desktop to my home computer. On my first trip, I failed because I didn't click the plus sign

early October, I stayed in my hometown for a week. On the third day, my wife called to say she had the report on the desktop at home and needed to use it early the next morning, asking if I could find a way to get the documents out. My main router is the Tenda AX12 Pro, with 500Mbps broadband from China Telecom and router dial-up. Under these conditions, setting up remote desktop is a natural approach: install a remote desktop client on your phone, connect it to your home computer, and operate it just like sitting in front of a computer. What really troubled me wasn't the computer side, but the port mapping rule in Tenda's backend—after the first setup, I couldn't connect at all. After checking around, I found the rule hadn't been added at all, just missing a plus sign. This article covers the five-step process and three pitfalls in one go. If you want to connect your home computer, hard drive, or surveillance cameras, follow along the way.

clarify this account first: when the external network knocks, the router needs to know who to pass it onto

the computer, hard drive, and camera at home are all internal network devices in the router's eyes. The address is like 192.168.0.x, and no one recognizes them outside the house. When you knock on the door of your home computer at work with your phone, you're actually knocking on a broadband public IP address, and the device holding the IP is a router, not your computer. Port mapping is the process of forwarding: you have agreed with the router that "any knock coming from a certain external port will be forwarded to port 192.168.0.106." Once the agreement is set, the phone connects to the public IP and designated port, the router automatically transfers to the computer, and the remote desktop is connected.

so one rule relies on three things: external port (which door you knock on from outside), internal IP (which device in your home you pass on), and internal port (which service on this device is listening). External and internal network ports can be filled in the same or different. My approach is different—let me explain the reasons below. If you want to fully understand this principle, the boundary between forwarding and DMZ, and when to use which to use, I have already explained this in the on port forwarding and DMZ, so I won't repeat it here.

two things before you start: fix the address number on the computer and open the remote desktop

many people fill out the rules correctly, but the problem is that the computer's IP address is automatically assigned by the router's DHCP. Today it's 106, after reboot it's 118, and the rules still foolishly point to 106, knocking and no one answers. So before mapping, the computer first fixes the house numbers. The easiest way is to perform DHCP static assignment in the router's backend, binding the computer's MAC and fixed IP together for a one-time solution. I wrote the specific steps in the on binding static IPs in , and the idea is universal. I have this desktop with 192.168.0.106, and I'll use it as an example in the rest of the text.

then open Remote Desktop. In Win11, search for 'Remote Desktop' in Settings, turn it on, and use your usual login account as the username. When the system turns on this switch, it will also allow the firewall rules to be enforced. Microsoft has designed this for you, so you generally don't need to manually enable the firewall. After opening it, first check the home internal network: take another device at home, connect to the browser or remote desktop client at 192.168.0.106. If it connects, it means the service is good. If it can't connect, only the router and the line will be suspected, so the investigation scope is half as small. The default port for Remote Desktop is 3389. Remember this number, and you'll need to fill in the rules later.

Five-Step Mapping Setup: The entry to the new interface is now under 'More'

the computer is ready, return to the router. Connect your phone or computer to Tenda's WiFi, enter tendawifi.com or 192.168.0.1 in the browser's address bar, and enter your login password to enter the backend. My AX12 Pro has a new interface, and the port mapping entry is hidden quite deep: "More"→ "Virtual Services"→ "Port Mapping" . Yes, it's not called port forwarding or virtual server. Tenda's new firmware management is called virtual service. If you follow the old tutorial to find the "Advanced Features → Virtual Server," you won't find it after searching for a long time—that's the path from the old interface. If the menu names on two generations don't match, I'll cover this pitfall for you.

After entering the

, open the port mapping switch, click 'New', and fill in four rules for each one:

After filling it in, the most critical step in the entire text begins: first click the plus sign on the right side of the input box, then click Save . In Tenda's interface, the plus sign is the action of "putting this rule into the list." The content you fill in is just a draft; if you don't click the plus sign, just click save. The rule doesn't even enter the list, and the interface doesn't show errors. You might think it's already matched. The first time I couldn't connect at home, the root cause was this problem. When I checked the backend, the rules list was empty. This plus sign is an old tradition at Tenda. When I wrote about Tengda checking online before, I ran into the same trap in the MAC filter: if you don't click the plus sign after filling in the MAC, it won't work all night—it's all cast from a mold. Once the rules are in the list, you can see the external 13389 pointing to the internal 3389. Save it, and the router end is complete.

external port, I deliberately left out 3389 and changed it to 13389. Scanners on public websites have been watching familiar numbers like 22, 3389, and 8080 for years. If you swap an external license plate for a niche high-level number, it's like moving the door from the main road into a small alley, greatly reducing the chance of the scanner hitting it. Anyway, the router will do handovers: you dial 13389 outside the door, listen 3389 inside the door, and you don't need to change anything on your computer.

three pitfalls I've encountered: plus signs, IP drift, and internal loop loops

Besides the number one pitfall of the Plus Sign, there are two other pitfalls worth mentioning, both of which I personally fell.

second is IP drift. When helping a friend with a connection, I tried to save effort and didn't do static binding. My computer was always 106 for several days, but everything was fine. Once, after a power outage in my neighborhood, the computer reconnected and got a 118 address, but the mapping rules still pointed to 106. The remote desktop lost contact instantly. From the outside, you can't see this kind of failure at all—it's just spinning in circles and timeout. So that static binding operation is really not optional, but a prerequisite. If you suspect drift, go home or have your family type the IPv4 address on this computeripconfig check the IPv4 address and match the rules to see the answer in seconds.

third is the intranet loop, which is the most intimidating. On the day I checked the phone at home, I tried to connect to the public IP plus 13389 with a phone connected to the home WiFi, but nothing worked. I thought all my specs were useless. In fact, this is because some routers do not support NAT loop: accessing their own public IP from the internal network means traffic cannot be routed through the router. To verify external connectivity, you really have to come from the external network—turn off the WiFi on your phone and connect with data once; once connected, it's connected. Later, I went back to my hometown and took the test in a row, but the half-hour of testing at home was completely wasted. By the way, if you set up the mapping to connect to your home NAS, the idea is exactly the same: just replace the internal port with the NAS's service port. There are also several alternative routes for remote access with fixed port mapping. NAS the remote access has a reference.

can't connect, check in this order: First, check who issued the WAN port IP

the rules are all in place, but testing from the external network still doesn't work. Don't rush to suspect the router. First, check what IP the WAN port holds. Tenda's backend homepage has internet settings. Check the four numbers on the WAN port — three sources and three fates:

I wrote about the

100.64 detection method and the script asking for public IPs when calling in article—just copy them directly. If the WAN port starts with 192.168, it means your optical modem is running in routing mode, with the public IP being held by it. Mapping on the router is like opening a door through a wall. There are two options: either map to the optical modem, and Tianyi Gateway's operation is in the section on port mapping for optical modem ; Or have the optical modem switch to bridge, or the router dial directly. If you have many devices at home, you can also check out the structure reference in the article the optical modem connects to two routers.

WAN is a public network, follow three steps: First, connect directly to the home network at 192.168.0.106 to verify the service. If it passes, it means the computer side is fine; Then go back to the backend to check whether the rules are in the list and if the IP port is copied incorrectly; Finally, I switched phones and tested data from external networks. After completing these three steps, the location is between the router and the carrier. If restarting the router once still doesn't work, use the WAN port IP and screenshot rules to report the ISP's fault. I've written about the same operation of the Mercury machine the Mercury port mapping article. The menu names differ, but the principles are all the same. If you have two brands at home, you can compare them.

don't go all out without a public IP: three escape routes are here

if the 10,000 people ask and the public IP really doesn't come, the mapping path is over—don't get hung up on the battle. There are three escape routes. The first point is IPv6: Carriers now issue IPv6 addresses by default, and each device has its own v6 address, so there's no need for port mapping or relay. I wrote about the V6 switch and precautions in Tenda's IPv6 . The trade-off is that your external phone must also be on the V6 network, and company WiFi may not be sufficient. The second is internal network penetration like FRP, which requires a relay machine with a public IP address. The cost of manipulation is higher, but it's the most stable. The third is the most worry-free: many device manufacturers come with built-in cloud channels. Synology's QuickConnect and the official hard drive enclosure app follow this approach. It's slower, but the advantage is zero specs.

finish with a sequence: first verify the service on the internal network, then bind the static IP, then the backend five-step rule setup, click the plus sign, save, and check the mobile data from the external network. If it doesn't work, first check the WAN port IP. With this whole system, even the business trip and the home computer went from "asking for help" to "just a few clicks." My weekly report was copied out in the last two minutes, and the previous three hours of pitfalls were treated as tuition payments for you.