Pi Node port forwarding means sending the ports listed in the Pi Node app from your router's public IP address to the computer that runs the node, so other nodes can connect to it. Since version 0.6.2, announced by Pi Network on August 14, 2026, the app can open those ports by itself with UPnP on routers that support it. If UPnP doesn't work on your network, you add the rule by hand. Then test the result in the app or with an online port checker that connects from outside your network. A port only shows as open while Docker and the node are running. If the idea is new to you, read how port forwarding works first.
Which ports does Pi Node need?
Pi Node ports are the ones shown on the port check screen of the Pi Node app you have installed. Pi Network doesn't publish a port list on its public pages. Its Pi Node page only says nodes need the "(initially) ability to open ports on local router", and the 0.6.2 release notes give no numbers. The app is the source to follow.
Write down every port, protocol and the app version, since the list can change between releases. Many community guides written before 0.6.2 list TCP 31400-31409, but they are not from Pi Network. If a guide and your app disagree, use the app.
What you need before you start
You need a computer that stays on, Docker running on it, access to your router's admin page and a public IPv4 address that belongs to your connection alone. The last one decides everything. If your provider shares one public IP between many customers (CGNAT), no router setting will open the ports.
- Uptime. Pi Network lists "Uptime (i.e., Online 24/7)" among its node criteria, so turn sleep off.
- Docker. Pi Network's Linux node page (updated January 31, 2026) asks for Docker and the Docker Compose v2 plugin, 150GB of disk to start (ideally 300GB), 4 vCPUs and 4GB of RAM, with Ubuntu 24.04 LTS suggested. Those figures are for the Linux node.
- Your router login. If you've never opened the admin page, follow the steps to log in to your router.
- A public IP. Compare the WAN IP on your router's status page with the IP on the CheckIP home page. A WAN IP that starts with 10 or 192.168, or falls between 100.64 and 100.127, means double NAT or CGNAT. See public vs private IP addresses to tell them apart.
Download Pi Node only from minepi.com and run it on a computer you own. In March 2025, police in Hanoi warned that investing in Pi Network carries serious risks, according to Vietnam News Agency. This guide covers the network setup only.
Option 1: open the ports automatically with UPnP
Pi Node UPnP support, added in version 0.6.2, lets the app ask your router to open the node ports, so you don't type any rules. Pi Network says it works "on supported routers". It is the fastest route with a single router.
- Update Pi Node to version 0.6.2 or later from minepi.com.
- Turn on UPnP in your router, usually under Advanced, NAT or WAN.
- Restart the node and run the port check in the app.
UPnP fails when the router has no UPnP, the provider has disabled it, two routers sit in a row (UPnP only opens ports on the router nearest the computer) or the line is behind CGNAT. Move to Option 2 in the first three cases. Malware can also use UPnP, so look at the router's UPnP mapping list now and then.
Option 2: set up Pi Node port forwarding manually
Manual forwarding takes four steps: give the node computer a fixed local IP, add a forwarding rule on the router, allow the same ports in the computer's firewall and keep the node running. Test once all four are done.
Reserve a local IP for the node computer
A rule points to one local IP, such as 192.168.1.20. If the router gives the computer another address after a power cut, the rule points at nothing. Use DHCP reservation (also called Address Reservation or Static Lease) to bind the computer's MAC address to one IP.
Add the forwarding rule
Open the Port Forwarding page (some routers call it Virtual Server or NAT) and fill it in with the values from your app. For a computer at 192.168.1.20:
| Field | What to enter |
|---|---|
| External port or range | The ports listed in the Pi Node app |
| Internal port or range | The same ports |
| Internal IP | 192.168.1.20 |
| Protocol | The protocol the app shows |
If the router takes one port per rule, create one rule per port. Fiber modems often have separate WAN connections for internet, TV and phone. Apply the rule to the internet one.
Allow the ports in Windows Defender Firewall
- Press Windows, type wf.msc and open Windows Defender Firewall with Advanced Security.
- Select Inbound Rules, then New Rule, then Port.
- Pick the protocol from the app and type its ports under Specific local ports, as a list with commas or a range with a hyphen.
- Choose Allow the connection, tick the profile your network uses and name the rule.
If Windows treats your home network as Public and the rule only covers Private, the rule does nothing. Don't switch the firewall off to test. On macOS, allow the node app and Docker in the firewall options. To see which ports the computer is listening on, use the guide to check which ports are open on your computer.
Keep Docker and the node running
A port reads closed when nothing listens behind it. Before each test, check that Docker has started, the node is on and the computer isn't asleep.
How to check Pi Node ports
A Pi Node port check works in two places: the checker inside the app, and an online tool that connects to your public IP from outside the network. Use both. The app tests what the node expects; the outside tool shows what the internet actually reaches. If they disagree, the difference tells you where to look.
Use the Pi Node port checker in the app
The Pi Node port checker is built into the app, and version 0.6.2 added "a new port checker container", according to Pi Network's release notes. Run it after every router or firewall change. It tests the exact ports your app version expects.
Check the ports from outside with CheckIP
- Copy your public IP from the CheckIP home page.
- Open the CheckIP port checker, paste the IP and enter one of the app's ports.
- Run the check, then repeat for each port.
The checker tests TCP from CheckIP's server, so it sees what another node on the internet sees. It works from your home Wi-Fi. Open means the connection reached the node. Closed means nothing answered. Filtered means something dropped it on the way. If the app and CheckIP disagree, confirm you tested the same ports the app uses and the app is current.
Pi Node ports not open? How to fix it
Pi Node port forwarding not working usually traces back to one of the seven causes below. The pattern matters: filtered on every port points to your provider, closed on every port points to the node computer, and a mix points to the rules. Match what you see to a row.
| Symptom | Likely cause | Fix |
|---|---|---|
| All ports filtered from outside | CGNAT or inbound blocking by the provider | See the CGNAT section |
| Router WAN IP is 192.168.x.x or 10.x.x.x | Double NAT behind the provider's modem | Forward on both devices, or bridge the modem |
| All ports closed | Docker or the node is off, or the PC sleeps | Start both, turn off sleep |
| Worked, then stopped after a reboot | New local IP, or the UPnP mapping expired | Reserve the IP, rerun the app's check |
| Only some ports open | Wrong range or a missing rule | Compare rules with the app's list |
| Router rule correct, ports still closed | Firewall rule on the wrong profile | Add the network's profile to the rule |
| VPN app running on the node PC | Replies leave through the VPN, not your router | Turn the VPN off while testing |
The CheckIP port checker page lists more general reasons a port shows closed or filtered.
Running Pi Node behind CGNAT
Behind CGNAT, your router gets an address from the shared range 100.64.0.0/10 defined in RFC 6598, and many customers share one public IP. Inbound connections stop at the provider's equipment, so a rule on your router can't help. UPnP fails for the same reason.
Ask your provider for a public IPv4 or static IP, which some sell as an add-on, or move to a plan that includes one. Paid VPN or tunnel services with port forwarding also exist. They send all node traffic through a third party, cost money each month, and many don't support port forwarding at all. Mobile networks usually use CGNAT, so phone hotspots rarely pass the port check.
Is it safe to open Pi Node ports?
Opening Pi Node ports carries limited risk if you open only what the app asks for, to one computer. The danger sits in the software that answers on those ports, so keeping the node and Docker updated matters more than the rule. Two habits cover the rest.
- Forward only the app's ports, only to the node computer, and never put that computer in the router's DMZ.
- Turn UPnP off if you forwarded by hand and nothing else needs it, and delete the rules when you stop running the node.
Frequently asked questions
Do I need port forwarding to run a Pi Node?
Pi Network's Pi Node page lists "(initially) ability to open ports on local router" among its node criteria, so plan for it. Since version 0.6.2, UPnP can open the ports for you on routers that support it. Manual forwarding is only needed when UPnP is off, missing or blocked by a second router.
Can I run Pi Node on mobile data or a hotspot?
You can install it, but the ports will rarely test as open. A hotspot adds the phone as another NAT layer on top of the carrier's CGNAT, and you can't forward ports on either. For the port check to pass, run the node on a fixed home line with its own public IP.
Does Pi Node port forwarding slow down my internet?
No. A forwarding rule only tells the router where to send incoming connections. The node itself does use bandwidth: Pi Network's Pi Node page says turning it on "will be using CPU, memory, hard drive and network resources". On a slow upload line, others at home may notice.
Do I need a static public IP for Pi Node?
Pi Network's public pages don't say a static IP is required. The ports need a public IP that belongs to your connection, not a shared CGNAT address. A dynamic public IP still accepts forwarded connections. If it changes, run the port check again to confirm the ports still answer.
