A VPN server behind CGNAT may not receive unsolicited inbound IPv4 traffic even when the local router forwards a port.
Before you change anything
This is a diagnostic entry point. The source supports the general check, not a confirmed root cause for your device.
What to check first
What address range appears on the router WAN side, and is another router upstream?
Record the exact model, hardware revision, firmware and recent change before adjusting settings. If you cannot answer the question, keep the cause open.
Narrow the likely path
| Observation | Next check |
|---|---|
| WAN is in 100.64.0.0/10 | Ask the ISP about carrier NAT and reachable addressing before opening ports. |
| WAN is private RFC 1918 | Identify the upstream router and choose a supported single-routing arrangement. |
| WAN appears public | Check router firewall and game-service status; do not expose router administration. |
Decision after the first test
Confirm the WAN is in shared address space, then consider an ISP-provided reachable address, supported IPv6 path or a trusted relay design.
Use a documented next step
Verify before escalating
After each change, repeat the exact failed task. If the result is unchanged, restore the previous setting and use the official support link for your exact hardware revision. Don’t assume a menu or capability from a related model.
Official sources
- RFC 6598 shared address space for carrier networks (full_text; checked 2026-11-01)
- ASUS WireGuard server setup (full_text; checked 2026-11-01)
Check your exact US model, hardware revision, and firmware on the linked support page before changing settings.