How to set up port forwarding on Xiaomi router? 192.168.31.1 Add rules in the advanced settings. If the external network cannot be connected, check the WAN port IP first.
A while ago, I installed Jellyfin on my old laptop and wanted to use my phone to watch dramas on my hard drive at home on the way to work. The router is Xiaomi AX3000T, everything is normal on the intranet, and the 5005 port of the laptop is used in the LAN. 192.168.31.66 can open ； But as soon as you go to the external network, use the public IP and add 5005 and it will turn around. At first, I thought that port forwarding was just a matter of clicking a switch. However, after going through the Mijia App, mobile web version, and computer version backend, I spent half a night to add the correct rules. Today I will talk about it completely from entrance to inspection.
Make it clear first: When is port forwarding necessary?
After all the devices at home go out, only one public IP is displayed to the outside world. This IP first falls on the WAN port of the router. When someone knocks on the door, the router doesn't know which device to point to the room behind the door, so it blocks everything by default. Port forwarding is to tell the router a sentence: Requests from external port 5005 are forwarded to the intranet 192.168.31.66 Port 5005 of this machine.
The scenarios I have encountered mainly fall into the following categories:: Jellyfin, Feiniu NAS and other audio and video file services, cameras and doorbells, and occasionally run a Minecraft server to connect to my cousin. What they have in common is that I want to actively initiate a visit "outside". Browsing web pages, watching videos and other operations such as home devices connecting to the outside by themselves do not require port forwarding. ； Broadband downlink speed and WiFi lag have nothing to do with it. Don’t add rules whenever it is slow.
Another common misunderstanding is that external network access to NAS can only rely on port forwarding. In fact, if both companies support it, you can also use the relay or VPN provided by the manufacturer. For example, Feiniu and Synology have one-click external networks. The disadvantage is that it is sometimes slow or requires a relay. Port forwarding is suitable for scenarios where you already have a public network IP and want to maximize the speed. The premise is that the public network IP can really fall to your router. This topic will be discussed separately later.
where is the entrance: 192.168.31.1 Advanced settings, not Mijia App
I was stuck on this step for ten minutes. I rummaged through the router toolbox in the Mijia App and found only anti-fraud, speed limit, and child mode, but no port forwarding. ； Mobile browser 192.168.31.1 , the simplified version comes out again, and the menu on the left cannot be seen. Later, I changed my computer and the browser failed. 192.168.31.1 , enter the common settings and then click on the advanced settings, and the port forwarding will be there.
The order is roughly: Connect the computer to the WiFi or network cable of the Xiaomi router and open the browser 192.168.31.1 , find Advanced Settings, find Port Forwarding. If you don't have a computer at hand, a mobile browser will work, but you have to manually click "Visit the web version" or set the browser to the desktop version of the web page, otherwise you will see a shrunken menu. I have written How to log in to Xiaomi router with mobile phone 192.168.31.1 This difference has been mentioned in this article, so I won’t repeat it here.
After entering the port forwarding page, click "Add Rule" or "Add Port Forwarding Rule". The AX3000T I had at the time had an empty list. After clicking Add, a row of input boxes popped up.: Rule name, protocol, external port, internal IP address, internal port. Different firmware names may differ by one or two characters, but the core is these five. Don’t close the page directly after filling in the form. There is a “Save and Validate” button at the bottom of the page. If you click less, it means it is not saved.
One thing to remind you first: If you even 192.168.31.1 If you can't open it, you need to clear the backend of the router first, and port forwarding is the next step. Can watch Xiaomi router 192.168.31.1 What should I do if I can’t open it and can’t get in? , click on that article to check first, otherwise you will not be able to enter the rules page.
How to fill in the four fields: Do not fill in the external port and internal port backwards
When adding a rule, give it a random name that you can understand, such as "Jellyfin5005". Generally, TCP is selected as the protocol first. If both TCP and UDP are required in the service description, select "TCP+UDP". Many web services only use TCP. There is no benefit in choosing a larger one. On the contrary, it also releases unnecessary UDP.
What's really easy to get wrong is external ports and internal ports. The external port is the number used to knock on the door from the outside, and the internal port is the number your device actually listens to. Like Jellyfin, I want the external network to use 8096 for better memory, fill in 8096 for the external port, and fill in the internal IP. 192.168.31.66 , fill in 8096 for the internal port. It's true that the numbers on both sides are the same, but if you don't want to use 8096 outside and change it to 18096, for example, then you have to look clearly: The external port is 18096 and the internal port is 8096. You cannot just write 18096 in both cases.
The pitfalls I have stepped on are more typical: When forwarding the camera, write the internal IP as the router’s 192.168.31.1 , the result is unreasonable no matter how you test it. The rule does not report an error, it just faithfully throws the packet to the router itself, and there is no corresponding service on the router at all. Therefore, before filling in the IP, you must first confirm the IP of the device instead of filling in the gateway address based on your impression.
The same is true for port range forwarding. Download tools and surveillance video recorders sometimes need to open a continuous port, such as 8000 to 8010. If the page supports ranges, the external range corresponds to the internal range. The internal IP is also filled in only for that device. Don't assign a port to two devices. The router will only match them in the order of the rules. The actual effect is often that the latter one will not take effect.
After setting up the external network, I still can’t connect to it.: Check the WAN port IP first, then follow these four steps
Herein lies my problem on the first night. The rules are filled in correctly, but mobile phone traffic is used to access the public IP: 5005, still unable to connect. Don't doubt that the rules are written incorrectly. Arrange them in this order.:
The first step is to access the device using IP and port on the intranet. Access from another mobile phone or computer under the same router 192.168.31.66:5005 , if it can be opened, it means that the service itself is not down. ； If the LAN cannot be opened, the problem lies with the service, the firewall, or the port itself, and has nothing to do with port forwarding. Windows, Feiniu, and Synology may all have their own firewalls. Make sure the internal network is accessible before forwarding to the external network.
The second step is to check the router’s WAN port IP. Enter 192.168.31.1 , look for "External IP" in Internet settings, network status or home page, and write down the address you see. Turn on mobile data access again ip.cn Or search "my IP" to compare the two. If the router WAN port IP starts with 192.168., 10., 100.64 to 100.127, or 172.16 to 172.31, and ip.cn A different address is displayed, indicating that the public IP address is not assigned to the Xiaomi router, but is NATed by the upper-level optical modem or operator.
The most common situation in this situation is that the optical modem is still dialing, the router has become a sub-router, or the operator has given a large intranet IP. Relying on Xiaomi router port forwarding alone cannot save the problem. You need to forward the corresponding port on the optical modem, or ask the operator for a public IP address/change the bridge connection. I have written about double NAT separately. What does double NAT mean? , it is also worth scanning the pit of changing the bridge first, otherwise it will be useless to change the two layers.
The third step is to use mobile phone traffic to test, do not use home WiFi to test. Some routers do not support NAT backflow, that is, if you use the public network IP to access yourself from the intranet, it will be blocked as a loopback. When I tried to connect to WiFi at home and couldn't test it, I thought the rules were all wrong. ； Later, I switched to mobile data and it was connected in one go. The principle and judgment of this pit are Port forwarding cannot be tested at home, but it works when using traffic when going out. I have written it before, you can remember one sentence first: Verify the external network and verify the traffic.
The fourth step is to confirm that the IP of the internal network device has not changed. After the router is restarted and the device is reconnected, DHCP may redistribute IP addresses. Yesterday’s 192.168.31.66 today may become 192.168.31.70 , the old IP in the rules will naturally not be found. The best way is to statically assign or IP bind this device so that the MAC address corresponds to an intranet IP. In the Xiaomi backend, you can browse the LAN settings and DHCP static allocation. The names of different firmwares are slightly different. If you can't find it, remember the device MAC first, and then check the IP again after restarting.
Do not enable port forwarding, UPnP, and DMZ at the same time
That night I wanted to be lazy and open the DMZ. After checking, I found out that DMZ throws all unmatched external traffic to an internal network device, which is equivalent to this device being completely exposed to the public network. Port forwarding only opens a few doors you specify. Security updates and password management of devices such as NAS and cameras may not keep up. Opening a DMZ is equivalent to pushing the entire machine out, which I don’t recommend.
UPnP is more worry-free. The program itself will apply to the router to open a port. It is indeed convenient to enable game consoles and BT downloads, but the problem is that some software installed at home may also apply for it secretly. After enabling it, the port list will have a lot of unintelligible entries. My own approach is: Normally turn off UPnP, and turn it on temporarily when you need to connect the game or download tools to run smoothly. ； If there are clear services that require long-term external network access, manual port forwarding does not rely on UPnP. The set of application actions behind UPnP, I am What does UPnP mean? I’ve broken it down, so I only remember one conclusion here.: If you can specify it manually, don't rely on it automatically for a long time.
One sentence about the relationship between the three: Port forwarding is to specify a door number to open the door, UPnP is to knock on the door by the device itself, and DMZ is to hand over the access control of the entire building to one device. Home scenarios prioritize manual port forwarding ； When there are many ports and you can’t figure out which ones to open, consider UPnP again. ； The DMZ is left until last, and system updates and strong passwords must be done on the device first.
Finally, follow this order. Don’t restart the router again.
I've broken down my process into five steps, and there's basically no mess if you follow them.: First, fix the IP of the internal network device and confirm that the LAN access is normal. ； Go ahead 192.168.31.1 Advanced settings add rules, the external port corresponds to the external port, and the internal IP corresponds to the device ； After saving and taking effect, check whether the WAN port IP of the router and the public IP found in the mobile phone traffic are the same. ； Then use mobile phone traffic to test from the external network ； If it fails, check double NAT and NAT backflow instead of restarting the router repeatedly.
If the internal network connection and WAN port IP are also public network IPs, the rules are not filled in incorrectly, and the external network still cannot be opened, then go back and check whether the device firewall and port are really listening. In Windows, you can use netstat on the command line to check. For Feiniu and Synology, you can check the firewall in the system settings. Port forwarding just opens the door, and there must be someone behind the door. It's not pretty but it's the most effective.
This article is the path of Xiaomi routers. The names of other brands' backends may be called port mapping, virtual server, and NAT settings. The principles are the same. If you are preparing to open the first rule now, it is recommended that you start with the intranet self-test I mentioned, which can save you half a night of detours.
