What is port forwarding and when do I need it?

Port forwarding tells your router that unsolicited traffic arriving on a specific port should be sent to a specific device on your local network. It exists because address translation cannot otherwise know where such traffic belongs. Outgoing connections are fine without it, since the router remembers who asked, but an incoming connection nobody requested has no such record.

You need it when something outside your network must initiate a connection inward: hosting a game server, running a service accessible from elsewhere, some peer-to-peer applications, and certain security camera or remote desktop setups.

To make it work reliably, the target device needs a stable local address, otherwise the rule points at whatever holds that address later. Reserving an address for the device in the router settings is the usual approach and is more robust than configuring it manually on the device.

There are two reasons a correctly configured rule still fails. The first is a second layer of address translation, either because you have added your own router behind the provider equipment, or because your provider places customers behind shared translation. In the latter case no configuration on your side can work, and the provider must offer an alternative arrangement. The second is a firewall on the destination device itself blocking the traffic after the router has forwarded it correctly.

It is worth being deliberate about the security implication. A forwarded port exposes that service to the entire internet, where it will be scanned within minutes. Anything exposed this way needs to be current, authenticated and worth exposing. For remote access specifically, a VPN into your network is a considerably safer arrangement than forwarding a management port.