Understand the path, then change the right thing
For a public service, start on the service’s own host, then test from the local network, then from outside. If the service fails locally, changing port forwarding is unlikely to fix it. For private team access or an outbound allowlist, choose that goal above to get a different check plan.
Your router’s WAN or Internet IPv4 is the useful comparison value. Your laptop’s LAN address and default gateway describe different parts of the network.
| Evidence | What it tells you | Next useful check |
|---|---|---|
Shared WAN: 100.64.0.0/10 |
Strong evidence of upstream shared addressing, commonly CGNAT | Confirm the exact WAN field and ask the ISP about inbound public IPv4 |
Private WAN: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 |
Another router or provider NAT may sit upstream | Identify who controls that upstream layer |
| WAN and public IPv4 match | No mismatch in those values | Test the listener, firewall and outside path |
| Outside TCP accepted | An endpoint accepted a TCP connection from one vantage at one time | Verify the intended application, TLS and authentication |
| Outside TCP timed out | No reply arrived within the check window | Investigate filtering, routing, NAT and the service; no single cause is proven |
This checker cannot inspect your ISP’s topology. Matching addresses do not prove an address is static, dedicated or reachable. An active rejection does not identify the rejecting device. A successful TCP connection does not establish application health or security. UDP and independent dual-stack reachability are outside this check.
What leaves your browser
Router WAN and manually entered public IPv4 values stay in the browser. They are not submitted, saved in browser storage or added to the URL. The worked example makes no diagnostic requests. Copied and downloaded reports redact addresses by default; you can explicitly include them.
Public-IP detection processes the source address of a request to Fibmesh. An outside TCP check is a separate, deliberate action: it sends the selected port and your authorization to Fibmesh, which derives the target from that request’s verified public source address. The diagnostic worker connects to that address and port, sends no application data and closes the socket. It does not accept an arbitrary address or scan a port range. Hosting providers may retain access logs.
Detection and outside checks may be unavailable on a local preview, an unverified proxy path or an unconfigured diagnostic deployment. The guided plan and local commands still work. A VPN or proxy may cause a request to represent that intermediary rather than the host you intend to test.
Choose access around the actual goal
For authorized people reaching private resources, explore Networks. For a selected web app or API, explore Publish. For public addressing, explore Public IPs. For controlled connections from a workload, explore Outbound. Confirm the deployment and access requirements of your chosen option.
Follow the complete port forwarding troubleshooting guide →Method
Address classification follows the RFC 1918 private IPv4 ranges, RFC 6598 shared space, and conservative handling of the IANA IPv4 and IPv6 special-purpose registries. Classification, information you provide and live measurements are shown separately.