View source for Port Forward Rules

<span style="display:none" class="helpSource network_port_forward_rules">Port_Forward_Rules</span>

= Port Forward Rules =

Port forwarding is a technique of rewriting the destination address and destination port of packets to send them to a new location. Port forwarding has many uses. The most common use is on networks doing NAT where internal servers have private addresses (ie 192.168.1.100), port forwarding allows the forwarding of traffic to the Untangle server's public IP to an internal host. 

For example, if the email server is behind Untangle with a private address (192.168.1.100) and Untangle has one public IP (1.2.3.4) which all hosts are "sharing" via NAT to reach the internet, then port forwarding can be used to forward TCP traffic to 1.2.3.4 port 25 (SMTP) to 192.168.1.100 port 25. 

Port Forwards Rules work like all rules in Untangle which is described in the [[Rules]] documentation. Rules are evaluated in order on all new sessions. The destination will be rewritten to the ''New Destination'' and the ''New Port'' of the first matching rule. If not rule matches, then no changes are made to the session.

'''If you are having issues with port forwards, it is suggested to follow the [[Port Forward Troubleshooting Guide]]'''

There are two types port forward rules. To add a ''Simple Rule'' click ''Add Simple Rule.'' To add a regular rule as described in the [[Rules]] documentation click ''Add''.

== Simple Rules ==

Simple rules less complex rules that allow for most use cases without the extra functionality that often leads to misconfiguration. It is suggested to always use simple port forward rules where possible.

[[Image:Network_port_forward_rules_simple.png|thumb|center|A simple port forward]]

* Enable Port Forward Rule
** If checked, the rule is enabled. If unchecked the rule has no effect and is disabled.
* Description
** A description of this rule. This is just for documentation.
* Protocol
** If "TCP" then only TCP traffic to the specified port is forwarded. If "UDP" then only UDP traffic to the specified port is forwarded. If "TCP & UDP" both TCP and UDP to the specified port is forwarded.
* Port
** This is a list of commonly forwarded ports. To specify an arbitrary port, select ''Other'' and specify the port.
* New Destination
** The new destination of the session after the port forward. Typically this is the internal machine like 192.168.1.100.

== ''Expert'' Rules ==

There are cases where a more complex are desired such as:

* forward non TCP/UDP protocols
** Simple Rules can only forward TCP and UDP
* changing the new destination port
** Simple Rules only rewrite the destination address, if you also want to change the destination address port expert rules are necessary. For example, forwarding TCP to 1.2.3.4 port 8080 to 192.168.1.100 port 80.
* further limiting what traffic is forwarded
** Expert Rules allow for additional conditions to limit when a port forward will match. For example, you can limit forwarded traffic to traffic from a specific interface, specific IP range, etc.
* only to a certain public IP (not all Untangle IPs)
** Simple Rules match all ''Destined Local'' traffic as describe in [[Rules]]. If your Untangle has multiple public IPs and you only want to forward traffic to one of them you can use Expert Rules.

'''IMPORTANT:''' The reason simple rules are encouraged is that users tend to misconfigure the port forward rule conditions. Adding '''MORE''' conditions means your port forward rule will match '''LESS''' traffic. For example, often users will specify to only forward traffic with "Source Interface = External" and then discover that traffic to a public IP from the internal interface is NOT forwarded because its source interface is NOT external.

[[Image:Network_port_forward_rules_expert.png|thumb|center|A port forward]]

* Enable Port Forward Rule
** If checked, the rule is enabled. If unchecked the rule has no effect and is disabled.
* Description
** A description of this rule. This is just for documentation.
* Conditions
** The conditions describing which sessions will match. As documented in [[Rules#Condition_List]]
* New Destination
** The new destination of the session after the port forward. Typically this is the internal machine like 192.168.1.100.
* New Port
** If blank, the new destination port will remain unchanged. If specified all matching sessions will be rewritten to the new destination port.

== Reservations ==

At the bottom of the Port Forward Rules tab there is a list of ''reserved'' ports that can not be forwarded because they are currently in use for Untangle services. These services can be moved to different ports in the [[Services]] tab if these ports are required for port forwarding.

= Port Forwarding FAQs =

{{:Port Forwarding FAQs}}