Port forwarding

Port forwarding routes connections through the firewall that Proton VPN uses to protect our customers. It’s a feature that is mainly useful to people who download and share files using P2P protocols such as BitTorrent, although it can also improve performance for online gamers.

Learn more about how port forwarding works

Port forwarding is currently available in our Windows, Mac, and Linux apps for everyone with a paid Proton VPN plan. If you have a free plan, you can upgrade to access it.

You can also manually configure port forwarding.

Learn how to manually set up port forwarding

Note that port forwarding is only permitted on our special P2P servers. These are marked with a double-arrow icon. Note also that you can’t use port forwarding and moderate (Type 2) NAT at the same time.

In this support article, we’ll look at:

• How to enable port forwarding on the Windows app
• How to enable port forwarding on the macOS app
• How to enable port forwarding using the Linux (GUI) app
• How to enable port forwarding using the Linux CLI
• How to configure port forwarding on qBittorrent
• How to configure port forwarding on Vuze
• How to configure port forwarding on uTorrent (Classic)

How to enable port forwarding

Windows

Port forwarding is only permitted on our special P2P servers. To find these, go to Home → Countries → P2P tab.

1. Select the Port forwarding shortcut on the home screen (you can also access the port forwarding settings via the ⚙ Settings menu).

2. Toggle the Port forwarding switch on. By default, you’ll now get notified when the active port number changes, but, if you prefer, you can turn this off.

3. When you activate port forwarding, the VPN app sends a request to the VPN server to open a random port. This will forward traffic from the internet to the app. To see the active port number, hover your mouse cursor over the Port forwarding shortcut on the Home screen.

You’ll also receive a Windows notification displaying the port number when port forwarding is first turned on, and when the active port number changes.

You’ll need this number to configure port forwarding on third-party software such as your BitTorrent client. Please note that when you disconnect and reconnect the VPN, the active port number will usually change.  

This means you may need to update the port forwarding settings on your BitTorrent client for each VPN session, but doing so is very quick and easy (see below), and the active port is available to use immediately. 

macOS

Currently, port forwarding on macOS is an early-access feature.

Port forwarding is only permitted on our special P2P servers. On our Mac app, these are marked with a double-arrow icon.

1. Select the Port forwarding shortcut on the home screen.

2. Select the Port forwarding On button. When you activate port forwarding, the VPN app sends a request to the VPN server to open a random port. This will forward traffic from the internet to the app. The active port number is shown underneath the Port forwarding On button.

You’ll need this number to configure port forwarding on third-party software like your torrenting client. Please note that, in most cases, the active port number will change when you disconnect and reconnect the VPN. 

This means you will probably need to reconfigure your P2P client for each VPN session. However, doing this is very quick and easy (see below), and the active port is available to use immediately. 

Linux (GUI) app

Port forwarding is only permitted on our special P2P servers. On our Linux app, these are marked with a double-arrow icon.

1. Open the app, go to Settings → Features, and toggle the Port forwarding switch on.

2. When port forwarding is activated, the VPN app sends a request to the VPN server to open a random port that will forward traffic from the internet to the app. The active port number used for this is shown in the information panel at the top of the main app window when you connect to one of our P2P VPN servers.

You’ll need this number to configure port forwarding on third-party software like your torrenting client. Please note that, in most cases, the active port number will change when you disconnect and reconnect the VPN. 

This means you will probably need to reconfigure your P2P client for each VPN session. However, doing this is very quick and easy (see below), and the active port is available to use immediately. 

The active port is also written to the file: /run/user/$UID/Proton/VPN/forwarded_port. This can be useful for triggering automating tasks like updating your torrent client configuration every time the port number changes.

Linux CLI

Enabling port forwarding for the Linux CLI is a two-stage process:

1. Enable port forwarding in the CLI

Open a terminal window and run:

protonvpn config set port-forwarding on

If you’re connected to the VPN, you’ll need to reconnect for the new setting to take effect.

2. Configure port forwarding

Follow the instructions in our How to manually set up port forwarding guide. Start from Step 2: Linux.

How to configure port forwarding in your BitTorrent client

Port forwarding will work in any BitTorrent app. We provide instructions for a few popular Windows torrent apps below, but the steps are similar for all such software. Just remember to disable any UPnP and NAT-PMP settings in your client. 

The reason for this is that UPnP and NAT-PMP settings can conflict with settings in the Proton VPN app.

qBittorrent

1. Enable port forwarding in the Proton VPN app (see above) and launch qBittorrent.

2. Go to Tools → Options → Connection and disable Use UPnP / NAT-PMP port forwarding from my router (it is enabled by default)

3. In the Port used for incoming connections field, enter the active port number shown in the Proton VPN app.

Click OK when you’re done.

To prevent IP leaks while you’re torrenting, you should take additional steps to ensure that qBitTorrent is bound to the correct interface. You can do so by following our guide on how to bind your BitTorrent client to the VPN interface.

Vuze

The screenshots below show Vuze in Beginner Mode(new window), but the steps are identical for all modes. 

1. Enable port forwarding in the Proton VPN app (see above) and launch Vuze.

2. Go to Tools → Options → Plugins → UPnP and uncheck (disable) Enable UPnP.

3. While still on the Options page, go to Connection and enter the active port number shown in the Proton VPN app.

Click Save when you’re done.

uTorrent (Classic)

1. Enable port forwarding in the Proton VPN app (see above) and launch uTorrent.

2. Go to Options → Preferences → Connection and uncheck (disable) both Enable UPnP port mapping and Enable NAT-PMP port mapping.

3. In the Port used for incoming connections field, enter the active port number shown in the Proton VPN app.

Click Apply when you’re done.

Opening a port carries a small risk. See Port forwarding security considerations for more details.

A word about online port checkers

Online port checker tools allow you to check for open ports on your device and verify that port forwarding is working correctly. However, open ports can only be detected if an application is actively listening on that port.

How port checker tools work

Port checker tools work in the following way:

1. Connection Attempt: The tool sends a request to establish a connection to the specified port on your public IP address. When using a VPN, this will be the IP address of the VPN server.

2. Response Analysis: It will then wait for a response:

• Open: If an application is actively listening on that port and port forwarding is working correctly, the port checker will successfully establish a connection and mark the port as open.
• Closed or Filtered: If no application is listening on the port, or if our firewall is blocking the connection (for example, if port forwarding is not working correctly), the port checker will either receive a “connection refused” message or the connection will time out. In these cases, the port will be reported as closed or filtered.

Example

Using the Proton VPN port forwarding feature, you have opened port 44375 in our NAT firewall. However, until you configure an app to listen on that port, an online port checker tool will return a closed or filtered result.

If you configure an app to listen on port 44375 (such as one of the torrent clients described above) and check again, the port checker tool will be able to connect to the app through our firewall and return an open result.