01 / Read the evidence
Understand the path, then change the right thing
For a public service, start on the service’s own host, then test from the local network, then from outside. If the service fails locally, changing port forwarding is unlikely to fix it. For private team access or an outbound allowlist, choose that goal above to get a different check plan.
Your router’s WAN or Internet IPv4 is the useful comparison value. Your laptop’s LAN address and default gateway describe different parts of the network.
Read across the evidence, its limits and the next useful check. Scroll horizontally if needed; keyboard users can focus the table region and use the arrow keys.
| Evidence | What it tells you | Next useful check |
|---|---|---|
Shared WAN: 100.64.0.0/10 |
Strong evidence of upstream shared addressing, commonly CGNAT | Confirm the exact WAN field and ask the ISP about inbound public IPv4 |
Private WAN: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 |
Another router or provider NAT may sit upstream | Identify who controls that upstream layer |
| WAN and public IPv4 match | No mismatch in those values | Test the listener, firewall and outside path |
| Outside TCP accepted | An endpoint accepted a TCP connection from one vantage at one time | Verify the intended application, TLS and authentication |
| Outside TCP timed out | No reply arrived within the check window | Investigate filtering, routing, NAT and the service; no single cause is proven |
This checker cannot inspect your ISP’s topology. Matching addresses do not prove an address is static, dedicated or reachable. An active rejection does not identify the rejecting device. A successful TCP connection does not establish application health or security. UDP and independent dual-stack reachability are outside this check.
Public network evidence
Public BGP observations, with their limits
The Network Explorer, where enabled, adds your announced prefix, all returned origin ASNs and their available registered names. An ASN is a network’s identifier in BGP, the system networks use to exchange reachability information. An origin is the network announcing the address space; it may differ from your retail ISP.
Its graph shows observed BGP adjacency, initially up to 12 neighbours with a searchable retained list of at most 200. Counts, truncation, retrieval time and available source timestamps appear with the data. An edge does not establish physical cabling, commercial peering, traffic volume or your exact packet path. A source timestamp may be unknown; retrieval time does not make a historical snapshot realtime.
On-demand collector paths run toward your announced prefix, from up to three collector locations, with at most two paths per location and 32 AS entries per path. AS sets retain their uncertainty. These observations do not trace your outbound route to Google, Netflix or another service. Public network data can be unavailable independently of IP detection or port checks.
The explorer can check up to six selected TCP ports, with no automatic probes, UDP or ranges. Each completed result shows the target, family, test time and actual worker vantage. No response is inconclusive; TCP acceptance does not verify application health, authentication or safety. Refusal may originate at a firewall. Stopped and unattempted ports remain untested.
02 / Understand the requests
What leaves your browser
Public-IP observation processes the request source at Fibmesh. When network enrichment is enabled, Fibmesh sends that address, its derived prefix and selected ASNs to RIPE NCC / RIPEstat for public network lookups. Lookups may be cached; available source and retrieval timestamps appear with the evidence. Network data is not inferred when the provider is disabled or unavailable. Hosting and data providers may retain access logs.
An outside TCP check is a separate deliberate action. It sends selected ports and your authorization to Fibmesh, which derives the target from the request’s verified public source. The isolated worker opens a TCP connection, sends no application data and closes the socket. VPNs, proxies and shared addressing may represent an intermediary rather than your device. Shared public addresses share the six-attempt-per-minute budget. Stop cancels queued checks; in-flight connections close at completion or their deadline. Job tokens expire after two minutes and are sent only in request bodies, never URLs.
Router WAN values and manually entered IPv4 values in the guided checker stay in the browser. Snapshots, reports and node selections are not saved in browser storage or cookies. Copied and downloaded reports redact addresses and prefixes by default, including addresses inside labels; inclusion requires an explicit choice. The visible report is available for manual copying when clipboard or download access is denied.
The explicitly labelled example makes no further diagnostic or provider requests and never substitutes for a failed visitor lookup. Local preview and unverified proxy paths may have no live observation. The method, example and troubleshooting guidance remain useful; no unavailable result is replaced with a fabricated value.
03 / Choose an access path
Choose access around the actual goal
For authorized people reaching private resources, explore Networks. For a selected web app or API, explore Publish. For public addressing, explore Public IPs. For controlled connections from a workload, explore Outbound. Confirm the deployment and access requirements of your chosen option.
Follow the complete port forwarding troubleshooting guide →04 / Check the method
Method
Address classification follows the RFC 1918 private IPv4 ranges, RFC 6598 shared space, and conservative handling of the IANA IPv4 and IPv6 special-purpose registries. Classification, information you provide and live measurements are shown separately.