Manual Port Forwarding

Port Forwarding

Location: Firewall → Port Forwarding

Lets devices on the internet reach a specific service on a specific device inside your LAN — the classic use case being a game server, a security camera's web interface, or a self-hosted service.

The four forwarding panels

• Individual Port Forwarding — one WAN port → one LAN host:port, with NAT translation.
• Port Range Forwarding — a range of WAN ports → the same range on one LAN host.
• Individual Port Opening — opens one port through to a LAN host without NAT translation (for IPv6, where every device already has a public-routable address and doesn't need translation, just a firewall hole).
• Port Range Opening — the range version of the same IPv6-oriented opening.

Adding a forwarded port

Field	Meaning
Description	Optional note for yourself.
Protocol	TCP, UDP, or both.
From Port	The WAN-side port (1–65535) the outside world connects to.
To IP	The LAN device's address.
To Port	The port on that LAN device to actually deliver the traffic to (doesn't have to match From Port).
Source Zone	Which WAN connection this forward applies to — matters if you have extra tagged connections from [[WAN Multi-VLAN

The range variant swaps From/To Port for a Start Port/End Port pair, still forwarding the whole range to one LAN device. Validation stops you from creating overlapping or duplicate forwards on the same port(s).

UPnP / NAT-PMP

A separate panel lets apps and games request their own port forwards automatically (the mechanism your game console or torrent client uses to "just work" without you manually forwarding anything). Settings: enable the service, view the table of currently active automatic forwards, and set the upload/download speed the router reports to requesting devices (informational only — the router doesn't enforce these numbers). Note in the UI: UPnP doesn't work well through a double-NAT setup (e.g. modem + router both doing NAT).

DMZ

A blunt-instrument option: forward everything not otherwise claimed by a specific rule above to one designated device. Useful for troubleshooting or a device that needs unpredictable ports, but it removes the firewall's protection for that device entirely — prefer specific port forwards where you can.

See also

• WAN Multi-VLAN — the source-zone selector this page's forwards can target