Make Sure You Are Receiving a Public IP Address

With any port forwarding, it is important to ensure that you are getting a publicly accessible address from your ISP. Before proceeding with configuring your port forwards, please ensure that you are obtaining a public IP address from your ISP.

Managing port forward rules

Navigate to the site Settings -> Firewall -> Port-forward/NAT. Here you can add, edit, import and export your port-forwarding rules. Delete rules by clicking the trash bin under the Actions column.

Creating a rule

After clicking + Add, the following configuration panel will appear. Hover over the question bubbles for more details about the format for each field. Name the rule by clicking the pen icon next to Rule.

When creating a new rule, you are immediately given the option to create a "Simple Port-forward". This allows you to quickly and easily create a port-forward rule for your devices on the LAN to be accessible on the internet. 

You can disable this to view more advanced options for port-forwarding below:

• Source - Address from which the traffic will originate. This is useful if you want to restrict access based on where the traffic is coming from, such as allowing only your office network's IP address to reach your home network.
• Source Port* - Port from which the traffic will originate. This is useful if you want to restrict access based on the port a device is sending traffic from, such as only allowing traffic that originates from a specific application or service on the source device.
• Destination - Address to which the traffic was originally sent. This is the address the remote device is trying to reach, not necessarily the address the router will ultimately forward it to, which is set in "Redirect to" below.
• Destination Port* - Port to which the traffic was originally addressed. This is the port the remote device is trying to reach (e.g., 443 for HTTPS, 22 for SSH), not necessarily the port the router will ultimately forward it to, which is set in "Redirect to" below.
• Redirect to - Address and/or port to which traffic should be routed when captured by the above rules. This is where traffic will be sent to when matched by the above rules.
• Protocols - Which types of traffic should be monitored for the above matching rules. TCP is most common, such as for web servers.
• Zone In/Out - Firewall zone from/to which traffic must originate (in) and be destined (out). WAN is considered external, while LAN is internal.
• Interface In/Out - Physical or logical network interface on which traffic must arrive (in) and depart (out), such as eth0 or br-lan. 
• Limit - Maximum packets per time slice allowed by this rule. The default is per second, but you may configure this with the menu beside the input field.

*Source Port and Destination Port are only available when using only TCP and/or UDP protocols

Editing rules

Click the name of a port-forward rule to change any settings, as described in the above section Creating a rule.

Import/Export

Rules may be exported as a json structure, allowing you to take a copy of any ruleset for review or enabling you to restore the rules in the future.

The import button expects the same json structured data. Importing is a quick way to restore rulesets or to copy in rules from another site.

Importing rules will overwrite your current rule list. However, holding the SHIFT key will turn the import button into "Additive Import", allowing you to add rules to your existing list, preventing them from being overwritten.

Reset

The Reset button restores the rules to their factory defaults.

Examples

Hosting a web server

In this simple port-forward rule, your Route10 will capture all HTTP traffic coming into your network and send it to your web server at 192.168.1.150. 

Demilitarized Zone (DMZ)

Below you will see an example for a demilitarized zone or DMZ. This passes all TCP/UDP traffic through to your internal host, such as a third-party firewall appliance.

Warning: This takes precedence over all services running on Route10 itself, primarily VPNs. Only forward the entire port range if no services on Route10 are being used from the internet. To continue using Route10 services, create multiple port-forward rules to leave a hole around the ports necessary for the service, e.g. for IPsec VPN :1-499 + :501-4499 + 4501-65535.