Guides / Custom ports

Run apps on your NAT VPS ports

Last updated 3 November 2026 · By Mohammad AlSaraf

About 10 minutes. Any distribution. For game servers, APIs, VPNs and anything else that is not a website on 80 or 443.

On a NAT VPS your server shares one IPv4 address, so most apps cannot use their usual port. Instead you give each app one of your own forwarded ports. This guide shows how for common software, how to check it works from outside, and how to hide the port number behind a DNS record.

1. Find your ports

Open your server in the client area. Your block of ports is listed on its page, for example 10050-10059. The first one goes to SSH (port 22 inside the server). Every other port goes to the same port number inside your server, TCP and UDP. In the examples below, replace 10051 to 10055 with your own.

2. Set the port in your app

Two things catch most people out:

• Listen on all addresses, not only 127.0.0.1 or localhost. Use 0.0.0.0 for IPv4 and :: for IPv6. An app on 127.0.0.1 cannot be reached from outside.
• Open the port in your firewall if you use one, for example ufw allow 10051.

3. Check it from inside and outside

On the server, see what is listening and on which address:

ss -tulpn

From your own computer, try to connect to the shared address and your port:

# Linux and macOS
nc -vz natbox.io 10051

# Windows PowerShell
Test-NetConnection natbox.io -Port 10051

"Succeeded" or "open" means it works. If it times out, the app is probably listening on 127.0.0.1 or the firewall blocks it. These commands test TCP. For a UDP app such as WireGuard, connect with its own client.

4. Hide the port with an SRV record

Some apps look up an SRV record in DNS to find the port by themselves, so people type a plain name with no port. Minecraft Java is the best known. At your DNS provider, add:

Players then join mc.example.com with no port. The target must be a hostname with an A record, which natbox.io is. TeamSpeak 3 works the same way with _ts3._udp. Web browsers do not use SRV records, so for websites link your domain to use ports 80 and 443 instead.

5. Or use any port over IPv6

Over IPv6 nothing is shared: every port on your /80 reaches your server. An app can keep its usual port, such as 25565 for Minecraft, for visitors who have IPv6. Point an AAAA record at your address and firewall what you do not use.

Good to know

• Over IPv4, only your own block is forwarded to you, plus 80 and 443 for the domains you link.
• Outgoing connections are not limited to your ports: your apps can connect out to any port except the blocked mail ports 25, 465 and 587.
• Need more ports? Larger plans have more: 10 on Nano, 20 on Box and Box CPU, 30 on Box Plus.

More guides: Host a Discord bot 24/7, Stop SSH brute-force attacks with fail2ban, Run your own Git server with Gitea.