Port forwarding

Configuration of port forwarding

Last adaption: 07.2026

New:

Wording of firewall rule services clarified

notempty

This article refers to a Beta version

12.2 11.7

Use of port forwarding

Many companies do not have a subnet with external IP addresses available. All computers are in a private network and are connected behind the IP of the router.
Port forwarding is used to forward requests on specific ports directed to the router's public IP to the internal server so that it can be reached from the Internet.

Network objects and services only need to be created if they do not already exist on the firewall in the form described here.
Objective: To make an internal server accessible from the Internet.

Configuration of the appliance

Create network object

For simple port forwarding, the server must first be created as a network object.
This must be done by clicking on Firewall Network Objects button Add object.

Caption	Value	Description	Add Network Object UTMuser@firewall.name.fqdn Firewall Network Objects Create network object
Name:	Server	Assign a unique name
Type:	Host	Select Host as type The target must be a network object of type Host with an IP address, otherwise the rule may have no effect.
Address:	192.168.176.11/---	Enter IP address of the server
Zone:	dmz0	The internal zone in which the server is located must be selected here. In the example dmz0.
Save and close		Save the network object and close the dialog.

Create firewall rules

A firewall rule with destination NAT must be created so that external users can now also access the server.
This must be done by clicking Firewall Packetfilter button Add Rule.
The rule must then be created as follows:

General
Source:	Internet	Allows the Internet as the source of the data packet	Add Rule UTMuser@firewall.name.fqdn Firewall Packetfilter Add firewall rule
Target:	Server	Allows the server to be the destination of the data packet The target must be a network object of type Host with an IP address, otherwise the rule may have no effect.
Service:	https	Service with which the port is to be addressed on the target computer
Action:	ACCEPT	Forwards the packet
NAT
Type:	DESTNAT	Select destination NAT
Networkobject:	external-interface	Network object that performs the translation of the IP addresses, i.e. the "nating"
Service:	https	Service with which the port is accessed from the Internet (externally)
Then the Update rules button must be clicked. After the last setup step has been completed, port forwarding is active.