Your portforwarding is working as expected. There's just a difference between:
- a forwarded port
- an open port
- a closed port
- a blocked port
Port forwarding is just a feature of your router that tells it to route packets to a specific port to a specific host. It will do that whether or not the destination host's port is actually open or closed.
If the destination host has the destination port closed, the router will still forward any connection request packets to the destination host, but the destination host will respond back with a
RST packet telling the remote host that the port is closed instead of a
SYN-ACK response to proceed with the connection. (This is the mechanism a TCP SYN ping is based on, and it's how many portscanners work.)
However, if the port is actively blocked by a firewall, then even the
RST response may be blocked. So the network activity will look like this:
- The external host sends a
SYN packet to the router (first step in a TCP connection request's 3-way handshake).
- The router receives the
SYN packet and reroutes it to the destination host.
- The destination host receives the
SYN packet, but it gets blocked by Windows Firewall. Even if eMule were running, the application wouldn't receive the connection request.
- The external host waits for a
SYN-ACK response telling it that the destination port is closed or the connection request has been accepted; however, nothing happens....
- Eventually, the external host's client application decides it's waited long enough, and the connection times out.
This is a characteristic of firewalls that simply drop traffic. A firewall that rejects traffic will still send an
RST response or an ICMP
destination unreachable. However, this exposes more information about the network to potential attackers, which is why some network admins prefer simply dropping blocked traffic.