You asked... The basic problem is that you can have more than one computer in your local network which all access the internet through your router. If you go to www.whatsmyip.org from different computers in your network you will get the same address (the router's ip-address, not your computer's address). Now if you host the game there's no way how the other player can address your computer. Your computer's IP address is not accessible from the outside (the internet). The router can be addressed but it doesn't know which computer in your local network is meant to receive the information. Port-forwarding just tells the router that all data coming from the outside on port 20595 (in this case) should be sent to your computer. As long as there's no application on your computer that is listening on this port there's no risk. When 0ad or another application listens to that port, an attacker can try to send information the application doesn't expect. This can be a danger if the application doesn't handle it properly. It could crash or even execute code from the attacker in the worst case. However the attacker needs to know which application listens on that port, he must know your IP address, he needs to spend a lot of time finding an error in the application that can be exploited and he needs to attack you just at the time the application is running and in the state he expects.