How set up Port Forwarding or a DMZ with a Virgin Media Hub 5

Home routers supplied by UK cable providers have long been a source of frustration for anyone wanting to do more than browse the web. Virgin Media's Hub 5 — still the standard-issue device for most Virgin Media broadband customers in 2026 — is a meaningful step forward from its predecessors, and it does support port forwarding properly. Whether you're self-hosting a service, running a home lab, accessing a NAS remotely, or exposing a local API to the outside world, understanding how to configure the Hub 5 correctly is worth your time. This article covers TCP port forwarding, DMZ configuration, DHCP reservations, modem mode trade-offs, and the security considerations that come with punching holes through your router.

TL;DR — Port forwarding on the Virgin Media Hub 5 works, and the interface is straightforward. The main pitfalls are DHCP address drift (solved with a reservation), Virgin's own port blocking in standard router mode (relevant if you need ports like 25 or 80), and the temptation to use DMZ when targeted port forwarding would be safer. Read on for the full picture.

The Hub 5 admin interface

Access the Hub 5 admin panel by navigating to 192.168.0.1 in your browser. The login screen asks only for a password, which is printed on the card attached to the back of the router. You can also check basic router status without logging in by selecting Check router status — useful for a quick diagnostic without your credentials to hand.

Understanding port forwarding

Port forwarding lets external devices reach a specific service running inside your local network. Your router sits between the public internet and your home devices, and by default it blocks all unsolicited inbound connections — which is exactly what you want for security. Port forwarding creates a deliberate exception: traffic arriving on a nominated external port is redirected to a specific internal IP address and port.

Common use cases in 2026 include remote access to a home server running Jellyfin or Plex, exposing a self-hosted Nextcloud or Immich instance, connecting to a home assistant hub, or providing inbound access for a WireGuard VPN endpoint. The principle is the same regardless of the application: you tell the router which port to watch, and where to send matching traffic.

One thing worth noting before you start: if your Virgin Media connection is behind Carrier-Grade NAT (CGNAT), port forwarding at the Hub 5 level won't be sufficient on its own, because your public IP is shared with other customers. Virgin Media has been gradually reducing CGNAT use on residential connections, but it's worth confirming you have a genuine public IP before investing time in configuration. You can check by comparing the WAN IP shown in the Hub 5 status page against your externally visible IP at a site like whatismyip.com — if they match, you're not behind CGNAT.

Port forwarding in the Hub 5

Navigate to Advanced Settings > Security > Port Forwarding. The interface is clean and requires minimal networking knowledge to operate. In the example below, port 443 (HTTPS) is forwarded to a local web server at 192.168.0.127.

The Hub 5 supports port ranges as well as individual ports, so if your application needs a contiguous block — a game server or a SIP trunk, for instance — you can define the range in a single rule rather than creating multiple entries.

DHCP reservations — essential, not optional

The port forwarding rule you just created points to a specific IP address. The problem is that DHCP — the protocol the Hub 5 uses to hand out IP addresses to devices on your network — allocates addresses dynamically. When your server reboots, it might receive a different IP address. Your port forwarding rule would then point at the wrong device, or at nothing at all, creating either a broken service or an unintended exposure.

The fix is a DHCP reservation: you tell the Hub 5 to always assign the same IP address to a particular device, identified by its MAC address. Every network adapter has a unique MAC address — a twelve-character hexadecimal identifier formatted with colons or hyphens (for example, 01:23:45:67:89:AB). It has nothing to do with Apple Mac computers; MAC stands for Media Access Control.

Find your device's MAC address in its network settings, or via the command line:

• Windows: ipconfig /all or getmac
• macOS: ifconfig en0 or check System Settings > Network
• Linux: ip link show or ifconfig -a
• Raspberry Pi / other Linux SBCs: ip link show eth0

Then navigate to Advanced Settings > DHCP and scroll to Add reserved rule:

Once the reservation is saved, that device will always receive the same address when it connects, regardless of reboots or lease renewals. Your port forwarding rule stays accurate indefinitely.

DMZ on the Virgin Media Hub 5

The Hub 5 includes a DMZ (Demilitarized Zone) option, found under Advanced Settings > Security > DMZ. Unlike port forwarding — which exposes only specific ports — enabling DMZ forwards all inbound connections that Virgin Media's own firewall permits to a single internal device. The target machine is effectively placed in front of the router's NAT layer and exposed directly to the internet.

The practical use case for DMZ is placing a second router or a dedicated firewall appliance as the DMZ host, so that it can handle its own port forwarding and security rules independently of the Hub 5. This is a common pattern in home labs where someone wants full control over their networking stack without putting the Hub 5 into modem mode. If you're pointing DMZ at a general-purpose computer rather than a dedicated firewall, you should ensure that machine runs its own robust firewall and that you understand exactly what services are listening on it.

Reports of DMZ appearing not to work on the Hub 5 are usually explained by Virgin Media's own port blocking. Certain ports — including the standard SMTP port 25, and in some configurations port 80 — are blocked at Virgin's network level regardless of what you configure on the Hub 5. If a port is blocked upstream, no local DMZ or port forwarding rule will make it reachable. This is not a Hub 5 bug; it's a deliberate network policy.

Modem mode and third-party routers

The Hub 5 can be switched into modem-only mode, which disables its routing, NAT, Wi-Fi, and firewall functions entirely. It passes a public IP directly to whatever device is connected to its LAN port — typically a third-party router. This is the preferred configuration for users who want full control: a dedicated router running OpenWrt, pfSense, OPNsense, or a commercial alternative like a UniFi gateway handles all routing and firewall duties.

The trade-off is real. In modem mode, the Hub 5 provides no protection whatsoever — your third-party router is the only thing standing between your network and the internet. If that router is misconfigured or unpatched, your exposure is significant. That said, for anyone running a home lab, hosting services, or simply wanting a more capable and transparent networking setup, modem mode paired with a well-maintained router is the cleaner long-term solution. OpenWrt in particular has seen strong development momentum and supports the Hub 5 modem-mode workflow well with a wide range of compatible hardware.

It's also worth knowing that switching to modem mode and back resets some Hub 5 settings, so document your port forwarding and DHCP reservation rules before making the switch.

Security considerations

Opening ports on a home router is not inherently dangerous, but it does require discipline. Every port you forward is a potential entry point if the service behind it has a vulnerability. A few principles worth keeping in mind:

• Only forward ports you actively need. Remove rules for services you've stopped running.
• Keep software up to date. An exposed service running outdated software is a significant risk. This applies especially to web servers, VPN endpoints, and anything with a login interface.
• Use non-standard ports where practical. Moving SSH from port 22 to a high-numbered port won't stop a determined attacker, but it dramatically reduces noise from automated scanners.
• Prefer a VPN for personal access. If you only need to reach your home network yourself, a WireGuard VPN endpoint (forwarding a single UDP port) is far safer than exposing individual services directly. WireGuard is fast, modern, and well-supported across all major platforms.
• Use a reverse proxy for web services. Tools like Caddy or Nginx Proxy Manager let you expose multiple web-based services through a single HTTPS port, with automatic TLS certificate management via Let's Encrypt. This is cleaner and more secure than forwarding multiple ports to multiple machines.

IPv6 is increasingly relevant here too. The Hub 5 supports IPv6, and if your devices have public IPv6 addresses, they may already be reachable from the internet without any port forwarding configuration — bypassing NAT entirely. Check the Hub 5's IPv6 firewall settings to ensure inbound IPv6 traffic is appropriately restricted.

Troubleshooting

If a port forwarding rule isn't working as expected, work through these checks in order:

• Confirm your public IP is not behind CGNAT. Compare the WAN IP in the Hub 5 status page with your externally visible IP. They must match.
• Verify the DHCP reservation is active. Reboot the target device after adding the reservation and confirm it received the expected IP.
• Check the service is actually listening. On the target machine, use netstat -tlnp (Linux) or netstat -ano (Windows) to confirm the service is bound to the expected port.
• Test from outside your network. Port checkers like portchecker.co or similar tools let you probe a port from an external vantage point. Testing from inside your own network won't reflect external reachability accurately due to NAT hairpinning limitations.
• Check for upstream port blocking. If a port test shows the port as closed despite a correct forwarding rule, Virgin Media may be blocking it at the network level. Try an alternative port if the application supports it.
• Restart the Hub 5 after making changes. Some rule changes require a router restart to take effect reliably.

Conclusion

Port forwarding on the Virgin Media Hub 5 is genuinely straightforward once you understand the underlying concepts. The interface is clean, DHCP reservations keep your rules stable, and the DMZ option — used carefully — gives you flexibility for more complex setups. The main constraints are Virgin's own port blocking policies and the CGNAT question, both of which are knowable and workable. For anyone who wants to go further, modem mode with a capable third-party router remains the most powerful option, at the cost of taking on full responsibility for your own network security.