VPN Port Forwarding: What It Does, and Why Providers Keep Removing It (2026)

A VPN normally works one way round: you open connections outwards, and answers come back down the tunnel you opened. Nothing on the internet can start a conversation with you. That is a large part of why a VPN feels safe.

Port forwarding is the exception you ask for. It tells the provider to accept incoming connections on a chosen port at its server, and hand them to your machine through the tunnel. It punches a way in.

A port number is a 16-bit field, so there are 65 536 of them, numbered 0 to 65535. IANA splits that space into three: 0 to 1023 are the system ports that need privilege to bind on Unix systems, 1024 to 49151 are registered, and 49152 to 65535 are ephemeral. Providers that still offer forwarding almost always allocate from the upper two blocks, which is why the port you are handed is a large, arbitrary-looking number rather than one you choose.

What it actually enables

BitTorrent connectability. Without an open port your client can only reach outwards, to peers that accept incoming connections. You still download, but you are invisible to a large share of the swarm and your upload suffers. With a forwarded port, other peers can reach you. That is why the question usually shows up in a qBittorrent or Deluge context.

BitTorrent's historic port range is 6881 to 6889, which is what many ISP filters and older firewall rules still look for; modern clients pick a random high port at first launch instead, precisely to avoid that signature. The state your client reports as "not connectable" is a throughput ceiling rather than a failure: you keep downloading, you simply reach a smaller part of the swarm.

Reaching something you host. A game server, a self-hosted service, an SSH port - anything that has to be dialled into rather than out of. Behind the VPN with no forwarded port, nobody outside gets to it.

Both are legitimate, and both need the same thing: an open door.

Why the door is being bricked up

This is the part most articles skip, and it matters more than any setup guide.

Mullvad removed port forwarding entirely. The announcement came on 29 May 2023, and existing forwarded ports were deleted on 1 July 2023. The stated reason was abuse: forwarded ports were used to host undesirable content and malicious services from Mullvad's own servers. The consequences the company listed are concrete - law enforcement making contact, IP addresses blacklisted, hosting providers cancelling service. That last one hits every user of the affected servers, not just the abuser.

CEO Jan Jonsson stated the structural problem plainly: "Since Mullvad is taking a great deal of effort into keeping users private, and not logging traffic, we can not block bad users or identify bad users, so we become a safe haven for bad stuff."

Read that twice, because it is the whole argument. A provider that genuinely does not log cannot identify who is abusing a forwarded port. It cannot ban the individual, because it does not know who the individual is. Its only lever is to close the feature for everyone.

The removal is therefore neither laziness nor cost-cutting. It is what happens when a no-log policy meets a feature that invites abuse. A provider that could police forwarded ports precisely would be a provider that knows far more about you than you want.

What that changes when you choose

Treat "port forwarding available" as a real differentiator, and ask what it costs. A provider offering it either absorbs the abuse burden or keeps enough information to manage it. Which of the two is worth knowing before you pay.

Do not assume a pricing page is current. This is exactly the kind of feature withdrawn quietly, and comparison tables are rarely updated. Check the provider's own status page or changelog rather than a third-party table - including ours.

A forwarded port is a permanent inbound opening. Whatever listens on it is exposed to the internet through the VPN, with the provider's IP in front. Reasonable for a hardened service, a poor idea for something set up in five minutes and forgotten.

If you cannot get one

For torrenting, a client without an open port still works - slower, with less of the swarm reachable. A degradation, not a failure, and acceptable for most people.

For hosting something reachable, the honest answer is that a commercial VPN is the wrong tool. A cheap VPS with its own public IP does the job properly, and the VPN stays for the traffic that should go out through it.