Before now, I was convinced that the safe default was port triggering. The idea of leaving ports permanently open just felt much riskier compared to opening a port only when an app needs it. I did the most rational thing: run the same FileZilla active-mode transfer under both rules while watching the inbound port throughout the process. The results showed that while triggering reduces idle exposure, it may not work as cleanly as I’d always imagined. Related I took DHCP away from my router, and my home network finally made sense My router still routed. I just moved the address book somewhere I could actually read it Forwarding didn’t wait for me to open anything Before I’d even launched the app, the router already knew where the traffic was going Even before FileZilla was launched, there was already a forwarding rule put in place and pointing at the test machine. I ensured the range was set to the same ports the client would use. After that, I left the app closed, and it was time …