Open ports on Viettel, VNPT, FPT modems

1. Which kind do you need?

Open the hostname page in the dashboard and check the mode. IPv6: you only need to allow the port in the IPv6 firewall (step 3b). IPv4: you need NAT port forwarding (step 3a). If unsure, do both.

2. Gather the values

• The device's home-network IP: on Windows open Command Prompt, run ipconfig, and read IPv4 Address (for example 192.168.1.50). On a phone, check Wi-Fi settings. Or look at the device list in the modem page.
• The modem page address: Default Gateway in ipconfig, usually 192.168.1.1. The username and password are usually printed under the modem.
• Service port: the port the device opens to outsiders. The external port is what outsiders type after the hostname; the internal port is what the device listens on. Usually both are the same.
• Give the device a fixed IP (DHCP reservation) in the modem so the rule keeps working when addresses change.

Common ports

• Web: 80 (HTTP), 443 (HTTPS)
• Windows Remote Desktop: 3389
• Camera RTSP: 554 (the camera web page is usually 80)
• Synology DSM: 5000 (HTTP), 5001 (HTTPS)
• SSH: 22

3. Open it on the modem

3a. IPv4: port forwarding (NAT)

Find NAT, Port Forwarding, or Virtual Server. Add a rule: protocol TCP (add UDP if the service needs it), external port, internal port, and the device IP, then save.

If the external port differs from the internal one (for example external 8080 to 80), outsiders must type the port: http://name.niti.vn:8080

3b. IPv6: allow it through the firewall

Find IPv6 Firewall, IPv6 Filter, or IPv6 Security and add an inbound allow rule: protocol TCP, the service port, and the device's IPv6 address. Get the right address with nslookup name.niti.vn or from the hostname page; it is the stable address, not the device's temporary address.

Your ISP may change the IPv6 prefix. Rules tied to the old address then stop working; if the modem lets you pick the device (by name or MAC), choose that instead.

If the modem has no IPv6 firewall section, call the technical hotline and ask them to open the IPv6 port for your device.

3c. DMZ: the last resort

Use it only when you cannot open individual ports: find DMZ, enable it, and enter the device IP. DMZ usually applies to IPv4 only.

4. Open it on the device itself

The device firewall must allow the port too: on Windows open Windows Defender Firewall and add an Inbound rule for the port; on a NAS or camera check the Security or Firewall section. This is a common cause when the modem rule is right but the port still looks closed.

5. Verify

Press Port check on the hostname page. The test runs from the Niti server, so it already checks from outside; you do not need another network.

Still closed?

• The service is not running, or the device firewall blocks it (step 4).
• You changed the external port: remember to type the port after the hostname.
• IPv4 is still closed with a correct rule: the ISP may use a shared IPv4 address (CGNAT). Compare the WAN IP on the modem status page with the IPv4 Niti shows; if they differ, ask the ISP for a public IP or use IPv6.
• An open IPv6 port suddenly closes: the ISP changed the IPv6 prefix; update the rule with the new address.

Notes by ISP

Bridge mode is only for people who already have their own router (MikroTik, pfSense…) dialing PPPoE. Switching the modem to bridge without one cuts your Internet.