How to Port Forward on a Zyxel Router, Including the CenturyLink C3000Z

To port forward on a Zyxel router or a CenturyLink C3000Z, sign in to the gateway, open Advanced Setup, then Security, and choose Port Forwarding. Pick the device you want to reach, enter the port or port range and the protocol, then select Apply. Before you start, give that device a fixed local IP address so the rule keeps working, and check that your connection is not behind carrier-grade NAT, which blocks incoming connections no matter what the router says.

Before you start

• Know the port numbers and protocol (TCP, UDP or both) your app needs. Plex, for example, uses TCP 32400; see our Plex port forwarding guide.
• Find the device’s local IP address in its network settings or the gateway’s device list.
• Reserve that IP in the gateway’s DHCP settings (often called DHCP reservation or static lease) so it does not change after a reboot.
• Have the admin password from the label on the modem.

Step by step on the CenturyLink C3000Z

1. Connect to your home network and open a browser to the gateway’s address. Most CenturyLink Zyxel modems use 192.168.0.1.
2. Sign in with the admin username and password from the modem label.
3. Select Advanced Setup, then Security, then Port Forwarding in the left sidebar.
4. Choose the device from the dropdown, or type its IP address.
5. Enter the starting and ending LAN port. For a single port, use the same number for both.
6. Pick the protocol: TCP, UDP or both.
7. Leave remote IP set to all IP addresses unless you only want one outside address to connect.
8. Select Apply. The rule appears in the Port Forwarding list at the bottom of the page, where you can remove it later.

For common apps, the Application Forwarding page on the same menu lets you pick an app by name instead of typing ports. For remote desktop, avoid exposing RDP directly to the internet; use a VPN or another secured remote-access method. Our remote desktop guide explains the options.

Other Zyxel routers

Zyxel builds gateways for many ISPs, and its own retail routers use similar menus. Look for NAT, Port Forwarding or Virtual Server under a Network, Security or Advanced section. The fields are the same: device IP, external port, internal port and protocol.

Test the rule

Testing from inside your home network often fails even when the rule works. Use a phone on cellular data, or an online open-port checker, while the app is running and listening on the port. If it fails, confirm the device IP has not changed, the protocol matches, and the device’s own firewall allows the port.

Check for CGNAT

If the WAN IP on the gateway’s status page does not match the public IP shown by a “what is my IP” site, you may be behind another router or carrier-grade NAT. A WAN address in 100.64.0.0/10 is a strong CGNAT clue. A forwarding rule on your own gateway cannot by itself get through upstream NAT. Our guides to checking for CGNAT and bypassing CGNAT cover the options, from asking for a public IP to using a tunnel.

Safety tips

• Forward only the ports an app needs, and delete rules you no longer use.
• Avoid DMZ unless nothing else works; it exposes every port on that device.
• Keep NAT turned on. CenturyLink recommends leaving it enabled.
• Consider leaving UPnP off and using manual rules if you want tighter control.