As you learned earlier in this module, Network Address Translation (NAT) provides exceptional privacy for home and small business networks. When internal computers initiate outbound web browsing sessions, the router creates temporary translation entries and permits the return traffic. However, NAT operates as a strict one-way street: any unsolicited packet arriving from the outside internet is immediately dropped because the router has no idea which internal computer should receive it.
What happens when you intentionally want to host an internal service accessible from the outside world? Perhaps your office runs an on-premise customer web portal, hosts a Network Video Recorder (NVR) for security camera feeds, or operates a local file server. To make an internal private server reachable from the public internet, you must configure Inbound Port Forwarding (also called Virtual Servers or Destination NAT).
How Inbound Port Forwarding Works
Port forwarding punches a permanent, controlled pinhole through your router's NAT firewall. You create an explicit forwarding rule that links an external TCP or UDP port number on the router's public WAN IP address to a specific private IP address and port inside your local network.
Here is what happens when an external client attempts to connect:
- An external internet user types your company public IP address into their browser:
https://203.0.113.2(which connects to destination port 443). - The packet arrives at the router WAN interface. Without port forwarding, the router drops the packet immediately as an unsolicited inbound probe.
- With port forwarding configured, the router inspects its Virtual Server table: "Any inbound traffic arriving on WAN port 443 must be forwarded to internal server 192.168.1.80 on port 443."
- The router rewrites the destination IP address from
203.0.113.2to192.168.1.80and transmits the frame out of its internal LAN port to the server. - When the server replies, the router rewrites the source address back to
203.0.113.2, preserving transparent end-to-end communication.
| Rule Name | External WAN Port | Internal Target IP | Internal Port | Application Purpose |
|---|---|---|---|---|
| Web Server | TCP 80 | 192.168.1.80 | 80 | Company public website or portal |
| Secure Web (HTTPS) | TCP 443 | 192.168.1.80 | 443 | Encrypted portal and cloud dashboard |
| CCTV Camera NVR | TCP 8080 (Custom) | 192.168.1.99 | 80 | Remote security surveillance monitoring |
| VPN Server | UDP 51820 | 192.168.1.5 | 51820 | Encrypted remote employee tunneling |
Port Redirection and Port Translation
Port forwarding also supports Port Redirection, where the external listening port is different from the internal server port. For example, your broadband provider might block incoming connections on standard HTTP port 80 to prevent residential customers from running unauthorized web servers.
To bypass this restriction, you can configure your router to listen externally on high port 8080, but translate and deliver that traffic internally to port 80 on your web server. When remote employees type http://203.0.113.2:8080 into their browser, the router transparently shifts the destination port to 80 before forwarding the packet across the internal LAN.
Security Considerations and Best Practices
Opening port forwarding rules requires caution. Because port forwarding exposes an internal device to the entire public internet, any unpatched vulnerability in that device's software can be exploited by automated scanning worms. Always follow these essential security rules:
- Always pair port forwarding with a Static DHCP Reservation or permanent static IP. If the internal server's IP changes via dynamic leasing, your port forwarding rule will suddenly send external internet traffic to someone else's laptop!
- Never expose unencrypted administrative interfaces like Telnet (port 23) or unencrypted HTTP management consoles directly to the public internet.
- Where possible, deploy a Demilitarized Zone (DMZ) or isolated guest VLAN for forwarded servers so that a compromised web server cannot access internal workstation subnets.
Hands-On Lab Practice
In this lab exercise, you will test an inbound port forwarding rule configured on an office SOHO gateway. You will simulate an external internet client connecting to the router's public WAN IP (203.0.113.2) on HTTP port 80, observe how the router translates the destination address, and confirm that the internal web server (192.168.1.80) receives and responds to the request.
Follow the checklist below. Confirm that external clients can access the published web portal while all other non-forwarded internal devices remain completely shielded behind the NAT firewall.