Port forwards#

A port forward sends connections arriving at the router on a port to a device behind it. On its own that achieves nothing: the forwarded connection still meets the Forward chain of the firewall, which on a default-drop router refuses it. So a new forward offers the rule that admits it, and — for devices inside the network that reach the service by its public name — the pair of rules that make that work too.

The fields#

Add port forward opens the editor; clicking a forward opens the same editor with its values and its counters.

Field	What it does
Description	The forward's name, shown in the table and in the list of pending changes.
Rule number	New forwards only. Suggested as ten past the highest forward, counting pending ones, so two forwards added before applying never share a number; a number already used is refused under the field.
Interface	Where the connections arrive, chosen from the router's interfaces — the uplink the router leaves by, for a new forward.
Protocol	TCP and UDP, TCP or UDP.
External port	A port, a range such as `8000-8100`, or several separated by commas.
Public address	Only when the interface has more than one address: the one the forward answers on.
Forward to	The device's address. Required.
Port on the device	Leave empty to keep the external port; a port or a range to change it.
Log connections	Every forwarded connection is logged.
Disabled	The forward stays in the configuration and forwards nothing.

Each value is checked as it is typed, and Add port forward or Save changes stays disabled until the forward is complete.

Admitting the connections#

Under Firewall, a new forward offers Allow these connections, on by default. It adds a Forward rule that accepts connections arriving on the forward's interface for the device's address — and, when the forward names ports, for that protocol and port on the device. The rule is numbered like the forward when that number is free in the Forward chain, and ten up until it finds one when it is not; it never replaces a rule you already have.

When a Forward rule already admits the connections — one for the same interface and device, or for the device's network — the editor says so instead, Forward rule 20 already allows these connections, and adds none.

The rule matches the inside address, because that is what the connection carries by the time the Forward chain sees it. It is an IPv4 rule; a service published on IPv6 needs no forward at all, only a Forward rule in the IPv6 family.

From inside the network#

A device inside the network that looks up the service's public name gets the router's own public address, and a plain forward does not answer it there. Also reachable on the public address from inside adds the two rules that do, for a new forward:

Inside interface — where those devices are.
Public address — the uplink's address, read from the router. When the uplink takes its address by DHCP the field says so: the rule names the address it has now, and stops matching when it changes.

The first rule sends connections for the public address, arriving from inside, to the device; the second makes those connections come from the router, so the device's answers go back through it rather than straight to a client that is not expecting them. The editor refuses the option when the inside interface has no network to derive, or when the number the second forward needs — one past the forward's — is already taken.

After you apply#

The new forward appears in the table with its counters at zero, and:

the counters move when the service is used. If they do not, the forward is not matching: check the interface, the protocol and the port.
the counters move but the service does not answer: the forward matches and something after it does not. The Forward rule is the first thing to check, and the device's own firewall the second.

Editing and deleting#

Every field above can be changed on an existing forward. Delete port forward asks twice, then removes the forward. It does not remove the Forward rule that was added with it, or the pair of rules for inside devices: they are rules of their own, on the Firewall page and in the Source NAT table.

The nineteen forwards of the reference workload — including a range of ports and one that changes the port on the device — read and edit here as they are.