Port forwarding

A port forward sends traffic arriving on a port of the gateway to a host inside the network.

To reach a web interface on a LAN device from the internet without opening a port, use a published service instead.

Creating a port forward

1. Open Security policy and switch to the NAT tab.
2. Click Add NAT → Port forward (inbound).
3. Fill in:
   • Incoming interface — the uplink receiving the traffic
   • Protocol — TCP or UDP
   • External Port — the port traffic arrives on
   • Target host — the internal host, as an address or a network object
   • Destination Port — the port on that host
   • Name
4. Click Create.
5. Add a firewall rule that allows the traffic (see below), then Apply Changes and Confirm.

A port forward needs a pass rule

The forward only rewrites the destination:

match in on egress proto tcp from any to (egress) port 443 rdr-to <srv_web> port 443

It does not allow the packet. The ruleset ends in a default deny, so a forward with no matching firewall rule redirects the packet and then blocks it. A forward that looks right but does not work is almost always missing that rule.

Let an integration write both

The published-service integration in the Server category of Integrations creates the host object, the service object, the port forward and the firewall rule together.

When a forward cannot work

The form checks the incoming interface's address:

• A carrier-shared address (CGNAT): the operator puts many customers behind one public address, so nothing can be forwarded to this device.
• A private address: another router in front of the device does the translating, so the same port must be forwarded there too.
• No address reported yet: whether the forward can work is unknown.

Good practice

• Point the forward at a network object, and give the host a DHCP reservation so it does not move.
• The forward accepts traffic from anyone who can reach the gateway's public address. To restrict who may connect, set the source in the firewall rule.