What is Port Forwarding?

Port forwarding (also called port mapping) is a Network Address Translation (NAT) technique that redirects incoming packets addressed to a specific external IP address and port to an internal address and port, letting devices outside the network reach a service hosted on a specific host inside the LAN.

Key takeaways

• Port forwarding maps an external address-port pair to an internal one.
• It is a form of NAT applied at the router or gateway’s WAN edge.
• Rules are not active by default; each one must be created explicitly.
• Common rule types: destination NAT, source NAT, static NAT, no NAT.
• Exposes an internal server, camera, or device to the public internet.

On this page: Why it matters · How it works · Types · Port Forwarding & Versa · FAQ

Why is port forwarding important?

Private LAN addressing and NAT hide internal hosts from the internet by default – good for security, but it also blocks legitimate uses. A self-hosted web app, a game server, a security camera’s remote-viewing app, or a remote-desktop session need something outside the network to open a connection inward, and ordinary outbound NAT has no rule for that packet. Port forwarding closes the gap without giving up NAT’s protection: it opens one address-and-port combination through the boundary to one host, while every other port stays unreachable.

That precision is the point: instead of a public IP per device or a full VPN for one service, an operator forwards only the protocol and port needed. Each forwarded port also becomes an entry point from the internet, so an over-broad rule expands what an attacker can reach.

What is port forwarding?

A router or gateway sits at the boundary between a private LAN and a public WAN address. Port forwarding configures that device to rewrite the destination of inbound packets: a packet arriving on the WAN address at a given port has its destination address and port changed to an internal host’s private IP and port, and the device tracks the flow so return traffic translates back correctly. This inbound rewrite is destination NAT – the direction that gives port forwarding its name, distinct from outbound source NAT, which lets internal hosts reach the internet.

A rule typically specifies the external interface and port, the internal address and port, and a protocol, with a precedence value to resolve overlapping rules.

Types of port forwarding

Static (manual) port forwarding is a persistent rule an administrator configures explicitly, mapping one fixed external port to one fixed internal host and port until removed – the standard case for a server or camera that must always be reachable. Dynamic port forwarding is opened automatically and temporarily by an application, typically through UPnP or NAT-PMP/PCP; convenient, but it trades away administrator visibility into what’s open. Port triggering is narrower still: the gateway watches a trigger port and, only then, opens a matching inbound port until the session ends. Taxonomies also distinguish port forwarding – destination NAT with port translation – from static NAT, which maps a whole address without translating ports.

Port Forwarding & Versa

Versa’s Titan Portal – the cloud console for Titan-managed CSG branch appliances – exposes port forwarding on the Network > LAN > Port Forwarding screen. WAN interfaces must be configured first, since only configured ones appear as choices, and port forwarding is not enabled by default: each rule is added explicitly.

A Titan rule has a name, an address-translation type – Destination NAT, Source NAT, Static NAT, or No NAT – a WAN interface, a precedence value, and, depending on type, internal and external addresses, ports, and a protocol. Creating the rule also inserts a matching entry into the firewall rule list, named with a _frd suffix; that entry can’t be edited or deleted, only disabled or reordered. The same screen also handles device IP address reservation, pinning a DHCP address so a rule’s internal target doesn’t drift.

Frequently asked questions

What is the difference between port forwarding and NAT?

Port forwarding is one specific case of NAT. General NAT translates addresses for traffic crossing a boundary, usually outbound traffic leaving a private network. Port forwarding is the inbound case: mapping one external address-and-port pair to an internal host so unsolicited traffic can reach it.

Is port forwarding a security risk?

It can be. Every forwarded port is a defined, reachable entry point from the internet, so a rule broader than necessary, or one targeting an unpatched service, expands the attack surface. Limiting rules to specific ports, protocols, and source addresses reduces that exposure.

What is the difference between static and dynamic port forwarding?

Static port forwarding is a rule an administrator configures manually, persisting until removed. Dynamic port forwarding is opened automatically by an application, typically through UPnP or NAT-PMP, for the length of a session, then closes once the session or a timeout ends.

Does port forwarding still matter with IPv6?

Less often. IPv6 generally gives each device a globally routable address, removing the private-addressing gap that port forwarding solves under IPv4. Some deployments still apply NAT-like rules to IPv6 for firewall segmentation, but plain port forwarding is mainly an IPv4-era concept.

Can one port-forwarding rule cover a range of ports?

Yes. Most implementations, including Versa’s Titan Portal, accept a matching port range on both the external and internal sides of a rule – for example, 200 through 300 – mapping a contiguous block of ports instead of configuring one port at a time.

More on port forwarding

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about port forwarding, these are worth looking at next.