Managing port forward rules

Navigate to the site Settings -> Firewall -> Port-forward/NAT. Here you can add, edit, import and export your port-forwarding rules. Delete rules by clicking the trash bin under the Actions column.

Creating a rule

After clicking + Add, the following configuration panel will appear. Hover over the question bubbles for more details about the format for each field. Name the rule by clicking the pen icon next to Rule.

Source - Address and/or port from which the traffic will originate. This is useful in case you want to restrict access based on the source address, such as allowing only your office network to pass through to your home network. Destination - Address and/or port to which the traffic was originally intended. This is the address and/or port that the remote device asked for, but not the final destination that the router will send the traffic to. Redirect to - Address and/or port to which traffic should be routed when captured by the above rules. This is where traffic will be sent to when matched by the above rules. Protocols - Which types of traffic should be monitored for the above matching rules. TCP is most common, such as for web servers. Zone In/Out - Firewall zone from/to which traffic must originate (in) and be destined (out). WAN is considered external, while LAN is internal. Interface In/Out - Firewall zone from/to which traffic must originate (in) and be destined (out). Limit - Maximum packets per time slice allowed by this rule. The default is per second, but you may configure this with the menu beside the input field.

Editing rules

Click the name of a port-forward rule to change any settings, as described in the above section Creating a rule.

Import/Export

Rules may be exported as a json structure, allowing you to take a copy of any ruleset for review or enabling you to restore the rules in the future.

The import button expects the same json structured data. Importing is a quick way to restore rulesets or to copy in rules from another site.

Reset

The Reset button restores the rules to their factory defaults.

Examples

Hosting a web server

In this rule, your Route10 will capture all HTTP traffic coming into your network and send it to your web server at 192.168.1.150.

Demilitarized Zone (DMZ)

Below you will see an example for a demilitarized zone or DMZ. This passes all TCP/UDP traffic through to your internal host, such as a third-party firewall appliance.

Warning: This takes precedence over all services running on Route10 itself, primarily VPNs. Only forward the entire port range if no services on Route10 are being used from the internet. To continue using Route10 services, create multiple port-forward rules to leave a hole around the ports necessary for the service, e.g. for IPsec VPN :1-499 + :501-4499 + 4501-65535.