Adding and Editing Port Forwarding Rules

Port forwarding passes a connection that arrives from the internet at a port of your public IP address to a server in your internal network. For example, you can forward connections arriving at port 443 of your public IP to your web server in the internal network.

Adding a rule

In the client area, open Services > Firewall. On the Port forwarding tab, click Add rule and fill in the form:

• Public IP: one of the public IP addresses assigned to your firewall.
• Protocol: TCP, UDP or both. TCP is enough for websites, remote desktop and SSH.
• Public port: one port (443) or range (5000-5010) per line; you can write several lines. A range can contain at most 1000 ports; a rule can have at most 15 ports or ranges.
• Target IP (internal network): the internal address of the server the connection is passed to. Your internal network is shown at the top of the page (example: 192.168.13.0/24).
• Target port: if left empty, the same port is used. To use a different port, the public port must be a single port; for example, you can forward public port 8080 to port 80 of the internal server.
• Allowed source IP addresses: if left empty, the port is open to everyone. See the article "Opening a Port Only to Certain IP Addresses".
• Description: a short note to recognise the rule (example: web server).
• Also reachable from my internal network (NAT loopback): ticked by default. See the article "Access from Your Internal Network (NAT Loopback)".

When you click Add rule, the rule is applied to your firewall and verified. This may take up to half a minute.

Rules that cannot be added

• On the same public IP and protocol, a port already used by another rule cannot be forwarded again. You can remove that rule first or choose another port.
• On your primary public IP, the ports reserved for managing the firewall itself (22 and 10443) cannot be forwarded.
• The number of rules you can add from the panel is limited. When only a few are left, the tab shows how many more you can add; when you reach the limit, you can open a support ticket to raise it.

Editing a rule

You can change a rule without deleting it. Click Edit on the rule's row and the form opens with the rule's current values. Make your changes and click Save changes; the rule is updated in place and verified. If you are not happy with the change, Undo last change returns the rule to its previous values.

Copying a rule

To add a similar rule, use the Copy button on the row. The form opens filled with all values of the copied rule (including allowed sources and NAT loopback). Since two rules cannot share the same public IP and port, change the port or the public IP and click Add rule.

Rule order

The firewall checks rules from top to bottom; if two rules match the same connection, the upper one applies. In the Order list in the first column you can choose a rule's new position; after you confirm, the rule moves there in one step (a single choice is enough to bring the bottom rule to the top). The arrows next to it move the rule one step up or down. A new order is also verified after it is applied and rolled back automatically if it cannot be confirmed.

Removing a rule

Click Remove on the rule's row and confirm. Connections arriving at that port are no longer forwarded. To remove several rules together, or to disable a rule temporarily without deleting it, see the article "Bulk Changes and Moving Rules with CSV".

Rules created by the support team

Rules our team defined for you show Created by the support team on their row. You can edit, copy and remove them just like your own rules; they do not count towards the number of rules you can add from the panel.

Who changed what and when

A changed rule shows Last edited on its row: whether you or the support team made the change, and when. The History link in the description column shows the rule's last ten changes (added, edited, order and NAT loopback changes) with old and new values.