Knowledge Base

How do I calculate the port range for IPv4 NAT?

(NEW) How do I automatically calculate my ports?

The IPv4 NAT external 10-port range is, funnily, calculated from the end of your... IPv6 address. 
Ports are always pre-opened and active at the given range for you.
This address is hybrid - has IPv6 + IPv4 connectivity.

In order to calculate the IPv4 NAT port range, you simply need to run this one-liner Linux command:
wget -O nat.sh https://cfld.uk/nat.sh && chmod +x nat.sh && ./nat.sh

In just 5 seconds, you will get all you need: 
- your current IPv6 on your VPS;
- the NAT IPv4 port range available from your IPv6, in TCP and UDP;
- and the external IPv4 IP that you shall use and point to/from. 

This command works immediately on Debian and Ubuntu operating systems.
On RHEL-based systems (e.g. AlmaLinux, Rocky Linux, Red Hat, Oracle), or systems that don't have wget installed, you will need to install wget. 

This is also a very simple one-liner Linux command on RHEL-based systems:
sudo dnf install wget -y

On Windows Systems

This script does not work directly without adjustments, due to Windows scripting processes behaving different than those of Linux. 
You will need to either:
- install Windows Subsystem for Linux (WSL), available on Server 2022, Server 2025 and Windows 11, and also ensure wget, bash and an internal Debian are installed, before running the command;
- run any virtual machine with a Linux OS under Windows that gets direct IP access, using the available tools (Vmware Workstation, VirtualBox, QEMU), and run the command directly, Debian-based OS being preferred.

After calculating your port range, you can uninstall the software on Windows. You only need a one-off install.

Explanation for the port calculation mechanism / Manual calculation procedures

For those willing to understand more, or simply for those with Windows on their VPS that understand well IPv6 and wish to save time, you have it all below.

IPv6 is a hexadecimal system, meaning that, past the usual allocation 0-9 on a given IP, you also have A-F.  Our IPv6s are usually given sequentially, but, due to the NAT implementation being made later, port allocation is organized slightly differently to the IPv6 allocation. 

An IPv6 address can range at its end, e.g. f800-f809, and then go f80a, f80b, etc. The "Decimal Range" shows the IP order you are located at from a normal standpoint, from 1 to 255, and it's used in combination with hexadecimal values. Check this explanatory table:

Port Range for TCP

An address ending on, for example, f80e::1, for example, is the 14th address on the decimal range;
Our ports allocation for TCP starts at 10000, meaning that each block has ports 10000-10009, 10010-10019, etc;
Therefore, you multiply and subtract to have your correct port allowance:

14 x 10 = 140
Port Start: 10000
Your Block of IPv4 Ports: 10000+140 = 10140-10149 , minus 10 ports = 10130-10139 is your port range.

Let's assume a harder example, one earlier on the table, for example an address ending on f8d1::1.

Per the previous table, this is the 209th address on the list (Decimal Range says "d0-df" does the range 208-223, therefore d1 is one address later than d0, making it the 209th address);
Remember the port allocation starts at 10000;
Therefore, you multiply to have your port allowance:

209 x 10 = 2090
Port Start: 10000
Your Block of IPv4 TCP Ports: 10000+2090 = 12090-12099, minus 10 ports = 12080-12089 is your TCP port range.

You always locate the address on the hexadecimal scale first, count to the equivalent on the decimal scale after, and after that, you multiply. To have your correct port allowance, you always subtract at the end.

This way, you'll always know in which order your IP address is, and therefore, which ports you have available.

The rule is the same regardless of the end having numbers only, numbers+letters or letters only.

Port Range for UDP

The same formula applies, with three central differences:
- the port allowance is 5 ports, and not 10;
- it always starts later than TCP ports. Currently, at port 13000 in all MultiVPS servers. 
- the port subtraction is of 5 ports, and not 10.

Using the same 1st example of the address that ends on f80e::1, which is the 14th address on the port range, you also multiply and subtract to have your correct range:

14 x 5 = 70
Port Start: 13000
Your Block of IPv4 UDP Ports: 13000 + 70 = 13070-13074, minus 5 ports = 13065-13069 is your UDP port range.

In the future, some servers may have a different port start for UDP (e.g. 20000 instead of 13000). If and when that happens, you can always check which server you're at, and go to this article in order to check where the port ranges for UDP start. At any moment, you can also send us a ticket.

Specific for the Delta1 server (TCP/UDP)

The following details apply for the Delta1 port calculation for IPv4 NAT:
- TCP port count begins at 10000 for addresses ending in 4xx; 12550 ending in 5xx; 15100 ending in 6xx; and 17650 for addresses ending in 7xx.
- UDP port count begins at 30000 for addresses ending in 4xx; 31275 ending in 5xx; 32550 ending in 6xx; and 33825 for addresses ending in 7xx.

ICMP is not supported on this mode, however the forwarding is in place.

Ports are opened automatically and global server-level listeners are in-place automatically - simply go ahead and use the range. If you want to test if your range is working on TCP and UDP, click here.

SSH and all TCP/UDP services at those port ranges are fully working. If you used to access the C-Servers Remote service, you don't need to do it now, as our NAT IPv4 will directly forward you to an SSH session, as long as the selected sshd_config port and the port range are respected. Enjoy!