Port Forward Rules - Revision history

Græmer: /* Port Forward Rules */

2022-05-03T16:43:14Z

Port Forward Rules

← Older revision		Revision as of 16:43, 3 May 2022
Line 1:		Line 1:
	<span style="display:none" class="helpSource network_port_forward_rules">Port_Forward_Rules</span>		<span style="display:none" class="helpSource network_port_forward_rules">Port_Forward_Rules</span>

	~~= Port Forward Rules =~~

	{{TriScreenshot\|config\|network\|port-forward-rules}}		{{TriScreenshot\|config\|network\|port-forward-rules}}

	Port forwarding is a technique of rewriting the destination address and destination port of packets to send them to a new location. Port forwarding has many uses. The most common use is on networks doing NAT where internal servers have private addresses (ie 192.168.1.100), port forwarding allows the forwarding of traffic to the ~~Untangle~~ server's public IP to an internal host.		Port forwarding is a technique of rewriting the destination address and destination port of packets to send them to a new location. Port forwarding has many uses. The most common use is on networks doing NAT where internal servers have private addresses (ie 192.168.1.100), port forwarding allows the forwarding of traffic to the NG Firewall server's public IP to an internal host.

	For example, if the email server is behind ~~Untangle~~ with a private address (192.168.1.100) and ~~Untangle~~ has one public IP (1.2.3.4) which all hosts are "sharing" via NAT to reach the internet, then port forwarding can be used to forward TCP traffic to 1.2.3.4 port 25 (SMTP) to 192.168.1.100 port 25.		For example, if the email server is behind NG Firewall with a private address (192.168.1.100) and NG Firewall has one public IP (1.2.3.4) which all hosts are "sharing" via NAT to reach the internet, then port forwarding can be used to forward TCP traffic to 1.2.3.4 port 25 (SMTP) to 192.168.1.100 port 25.

	Port Forwards Rules work like all rules in ~~Untangle~~ which is described in the [[Rules]] documentation. Rules are evaluated in order on all new sessions. The destination will be rewritten to the ''New Destination'' and the ''New Port'' of the first matching rule. If not rule matches, then no changes are made to the session.		Port Forwards Rules work like all rules in NG Firewall which is described in the [[Rules]] documentation. Rules are evaluated in order on all new sessions. The destination will be rewritten to the ''New Destination'' and the ''New Port'' of the first matching rule. If not rule matches, then no changes are made to the session.

	'''If you are having issues with port forwards, it is suggested to follow the [[Port Forward Troubleshooting Guide]]'''		'''If you are having issues with port forwards, it is suggested to follow the [[Port Forward Troubleshooting Guide]]'''
Line 42:		Line 40:
	* further limiting what traffic is forwarded		* further limiting what traffic is forwarded
	** Expert Rules allow for additional conditions to limit when a port forward will match. For example, you can limit forwarded traffic to traffic from a specific interface, specific IP range, etc.		** Expert Rules allow for additional conditions to limit when a port forward will match. For example, you can limit forwarded traffic to traffic from a specific interface, specific IP range, etc.
	* only to a certain public IP (not all ~~Untangle~~ IPs)		* only to a certain public IP (not all NG Firewall IPs)
	** Simple Rules match all ''Destined Local'' traffic as described in [[Rules]]. If your ~~Untangle~~ has multiple public IPs and you only want to forward traffic to one of them you can use Expert Rules.		** Simple Rules match all ''Destined Local'' traffic as described in [[Rules]]. If your NG Firewall has multiple public IPs and you only want to forward traffic to one of them you can use Expert Rules.

	'''IMPORTANT:''' The reason simple rules are encouraged is that users tend to misconfigure the port forward rule conditions. Adding '''MORE''' conditions means your port forward rule will match '''LESS''' traffic. For example, you might specify to only forward traffic with "Source Interface = External" and then discover that traffic to a public IP from the internal interface is NOT forwarded because its source interface is NOT external.		'''IMPORTANT:''' The reason simple rules are encouraged is that users tend to misconfigure the port forward rule conditions. Adding '''MORE''' conditions means your port forward rule will match '''LESS''' traffic. For example, you might specify to only forward traffic with "Source Interface = External" and then discover that traffic to a public IP from the internal interface is NOT forwarded because its source interface is NOT external.
Line 62:		Line 60:
	== Reservations ==		== Reservations ==

	At the bottom of the Port Forward Rules tab there is a list of ''reserved'' ports that can not be forwarded because they are currently in use for ~~Untangle~~ services. These services can be moved to different ports in the [[Services]] tab if these ports are required for port forwarding.		At the bottom of the Port Forward Rules tab there is a list of ''reserved'' ports that can not be forwarded because they are currently in use for NG Firewall services. These services can be moved to different ports in the [[Services]] tab if these ports are required for port forwarding.

	= Port Forwarding FAQs =		= Port Forwarding FAQs =

	{{:Port Forwarding FAQs}}		{{:Port Forwarding FAQs}}

Græmer: /* Expert Rules */

2021-11-04T23:39:36Z

Expert Rules

Græmer: /* Simple Rules */

2021-11-04T23:37:09Z

Simple Rules

← Older revision		Revision as of 23:37, 4 November 2021
Line 17:		Line 17:
	== Simple Rules ==		== Simple Rules ==

	Simple rules ~~less complex rules that~~ allow for most use cases ~~without the~~ extra ~~functionality that often leads~~ to ~~misconfiguration~~. It is suggested to always use simple port forward rules where possible.		Simple rules allow for most use cases and avoid extra configuration, which can lead to non-functional forwards. It is suggested to always use simple port forward rules where possible.

	[[Image:Network_port_forward_rules_simple.png\|thumb\|center\|A simple port forward]]		[[Image:Network_port_forward_rules_simple.png\|thumb\|center\|A simple port forward]]

Bcarmichael: /* Simple Rules */

2021-05-25T23:17:22Z

Simple Rules

← Older revision		Revision as of 23:17, 25 May 2021
Line 28:		Line 28:
	** If "TCP" then only TCP traffic to the specified port is forwarded. If "UDP" then only UDP traffic to the specified port is forwarded. If "TCP & UDP" both TCP and UDP to the specified port is forwarded.		** If "TCP" then only TCP traffic to the specified port is forwarded. If "UDP" then only UDP traffic to the specified port is forwarded. If "TCP & UDP" both TCP and UDP to the specified port is forwarded.
	* Port		* Port
	** This is a list of commonly forwarded ports. To specify an arbitrary port, select ''Other'' and specify the port.		** This is a list of commonly forwarded ports. Use commas to separate multiple ports, or a dash to denote a range. To specify an arbitrary port, select ''Other'' and specify the port.
	* New Destination		* New Destination
	** The new destination of the session after the port forward. Typically this is the internal machine like 192.168.1.100.		** The new destination of the session after the port forward. Typically this is the internal machine like 192.168.1.100.

Dmorris at 18:58, 12 June 2017

2017-06-12T18:58:18Z

← Older revision		Revision as of 18:58, 12 June 2017
Line 2:		Line 2:

	= Port Forward Rules =		= Port Forward Rules =

			{{TriScreenshot\|config\|network\|port-forward-rules}}

	Port forwarding is a technique of rewriting the destination address and destination port of packets to send them to a new location. Port forwarding has many uses. The most common use is on networks doing NAT where internal servers have private addresses (ie 192.168.1.100), port forwarding allows the forwarding of traffic to the Untangle server's public IP to an internal host.		Port forwarding is a technique of rewriting the destination address and destination port of packets to send them to a new location. Port forwarding has many uses. The most common use is on networks doing NAT where internal servers have private addresses (ie 192.168.1.100), port forwarding allows the forwarding of traffic to the Untangle server's public IP to an internal host.

Dmorris at 20:50, 17 July 2013

2013-07-17T20:50:27Z

New page

<span style="display:none" class="helpSource network_port_forward_rules">Port_Forward_Rules</span>

= Port Forward Rules =

Port forwarding is a technique of rewriting the destination address and destination port of packets to send them to a new location. Port forwarding has many uses. The most common use is on networks doing NAT where internal servers have private addresses (ie 192.168.1.100), port forwarding allows the forwarding of traffic to the Untangle server's public IP to an internal host.

For example, if the email server is behind Untangle with a private address (192.168.1.100) and Untangle has one public IP (1.2.3.4) which all hosts are "sharing" via NAT to reach the internet, then port forwarding can be used to forward TCP traffic to 1.2.3.4 port 25 (SMTP) to 192.168.1.100 port 25.

Port Forwards Rules work like all rules in Untangle which is described in the [[Rules]] documentation. Rules are evaluated in order on all new sessions. The destination will be rewritten to the ''New Destination'' and the ''New Port'' of the first matching rule. If not rule matches, then no changes are made to the session.

'''If you are having issues with port forwards, it is suggested to follow the [[Port Forward Troubleshooting Guide]]'''

There are two types port forward rules. To add a ''Simple Rule'' click ''Add Simple Rule.'' To add a regular rule as described in the [[Rules]] documentation click ''Add''.

== Simple Rules ==

Simple rules less complex rules that allow for most use cases without the extra functionality that often leads to misconfiguration. It is suggested to always use simple port forward rules where possible.

[[Image:Network_port_forward_rules_simple.png|thumb|center|A simple port forward]]

* Enable Port Forward Rule
** If checked, the rule is enabled. If unchecked the rule has no effect and is disabled.
* Description
** A description of this rule. This is just for documentation.
* Protocol
** If "TCP" then only TCP traffic to the specified port is forwarded. If "UDP" then only UDP traffic to the specified port is forwarded. If "TCP & UDP" both TCP and UDP to the specified port is forwarded.
* Port
** This is a list of commonly forwarded ports. To specify an arbitrary port, select ''Other'' and specify the port.
* New Destination
** The new destination of the session after the port forward. Typically this is the internal machine like 192.168.1.100.

== ''Expert'' Rules ==

There are cases where a more complex are desired such as:

* forward non TCP/UDP protocols
** Simple Rules can only forward TCP and UDP
* changing the new destination port
** Simple Rules only rewrite the destination address, if you also want to change the destination address port expert rules are necessary. For example, forwarding TCP to 1.2.3.4 port 8080 to 192.168.1.100 port 80.
* further limiting what traffic is forwarded
** Expert Rules allow for additional conditions to limit when a port forward will match. For example, you can limit forwarded traffic to traffic from a specific interface, specific IP range, etc.
* only to a certain public IP (not all Untangle IPs)
** Simple Rules match all ''Destined Local'' traffic as describe in [[Rules]]. If your Untangle has multiple public IPs and you only want to forward traffic to one of them you can use Expert Rules.

'''IMPORTANT:''' The reason simple rules are encouraged is that users tend to misconfigure the port forward rule conditions. Adding '''MORE''' conditions means your port forward rule will match '''LESS''' traffic. For example, often users will specify to only forward traffic with "Source Interface = External" and then discover that traffic to a public IP from the internal interface is NOT forwarded because its source interface is NOT external.

[[Image:Network_port_forward_rules_expert.png|thumb|center|A port forward]]

* Enable Port Forward Rule
** If checked, the rule is enabled. If unchecked the rule has no effect and is disabled.
* Description
** A description of this rule. This is just for documentation.
* Conditions
** The conditions describing which sessions will match. As documented in [[Rules#Condition_List]]
* New Destination
** The new destination of the session after the port forward. Typically this is the internal machine like 192.168.1.100.
* New Port
** If blank, the new destination port will remain unchanged. If specified all matching sessions will be rewritten to the new destination port.

== Reservations ==

At the bottom of the Port Forward Rules tab there is a list of ''reserved'' ports that can not be forwarded because they are currently in use for Untangle services. These services can be moved to different ports in the [[Services]] tab if these ports are required for port forwarding.

= Port Forwarding FAQs =

{{:Port Forwarding FAQs}}

← Older revision		Revision as of 23:39, 4 November 2021
Line 34:		Line 34:
	== ''Expert'' Rules ==		== ''Expert'' Rules ==

	There are cases where a more complex ~~are~~ desired such as:		There are cases where a more complex rule is desired, such as:

	* forward non TCP/UDP protocols		* forward non TCP/UDP protocols
	** Simple Rules can only forward TCP and UDP		** Simple Rules can only forward TCP and UDP
	* changing the new destination port		* changing the new destination port
	** Simple Rules only rewrite the destination address~~, if~~ you also want to change the destination ~~address~~ port expert rules are necessary. For example, forwarding TCP to 1.2.3.4 port 8080 to 192.168.1.100 port 80.		** Simple Rules only rewrite the destination address. If you also want to change the destination port, expert rules are necessary. For example, forwarding TCP to 1.2.3.4 port 8080 to 192.168.1.100 port 80.
	* further limiting what traffic is forwarded		* further limiting what traffic is forwarded
	** Expert Rules allow for additional conditions to limit when a port forward will match. For example, you can limit forwarded traffic to traffic from a specific interface, specific IP range, etc.		** Expert Rules allow for additional conditions to limit when a port forward will match. For example, you can limit forwarded traffic to traffic from a specific interface, specific IP range, etc.
	* only to a certain public IP (not all Untangle IPs)		* only to a certain public IP (not all Untangle IPs)
	** Simple Rules match all ''Destined Local'' traffic as ~~describe~~ in [[Rules]]. If your Untangle has multiple public IPs and you only want to forward traffic to one of them you can use Expert Rules.		** Simple Rules match all ''Destined Local'' traffic as described in [[Rules]]. If your Untangle has multiple public IPs and you only want to forward traffic to one of them you can use Expert Rules.

	'''IMPORTANT:''' The reason simple rules are encouraged is that users tend to misconfigure the port forward rule conditions. Adding '''MORE''' conditions means your port forward rule will match '''LESS''' traffic. For example, ~~often users will~~ specify to only forward traffic with "Source Interface = External" and then discover that traffic to a public IP from the internal interface is NOT forwarded because its source interface is NOT external.		'''IMPORTANT:''' The reason simple rules are encouraged is that users tend to misconfigure the port forward rule conditions. Adding '''MORE''' conditions means your port forward rule will match '''LESS''' traffic. For example, you might specify to only forward traffic with "Source Interface = External" and then discover that traffic to a public IP from the internal interface is NOT forwarded because its source interface is NOT external.

	[[Image:Network_port_forward_rules_expert.png\|thumb\|center\|A port forward]]		[[Image:Network_port_forward_rules_expert.png\|thumb\|center\|A port forward]]
Line 58:		Line 58:
	** The new destination of the session after the port forward. Typically this is the internal machine like 192.168.1.100.		** The new destination of the session after the port forward. Typically this is the internal machine like 192.168.1.100.
	* New Port		* New Port
	** If blank, the new destination port will remain unchanged. If specified all matching sessions will be rewritten to the new destination port.		** Optional. If blank, the new destination port will remain unchanged. If specified, all matching sessions will be rewritten to the new destination port.

	== Reservations ==		== Reservations ==