This doc does NOT work for Firewalla: Transparent Bridge Mode
Gold and Purple maintain private networks in router mode and DHCP mode. Firewalla will block inbound traffic from the public to secure your network by default. If you want to access your local device or server from the public, port forwarding is an approach to let your traffic in.
How to do port forwarding?
For example: If you need to forward TCP port 8835 to your server local port 8853
On box main page, tap Network to open Network manager, tap NAT Settings -> Port forwarding -> Add Port Forwarding to create a new port forwarding.
Set Protocol to TCP, set the External Port to 8853; Internal Port to 8835.
Some devices may have multiple IP addresses associated with the MAC address, in this case, Firewalla may not be able to discover them as normal devices. Firewalla let you create port forwarding per device or IP.
How to limit access to the open port?
To keep your network as secure as possible with ports open, Firewalla supports limiting ingress traffic through the open. When you are creating a port forwarding, there will be an option Ingress firewall. This option controls how the open port is managed.
- Any Sources: All ingress traffic will always be allowed.
- None: All ingress traffic will be blocked unless allow rules are created on the local port. It provides an option to schedule the access via separate rules.
- Selected Sources: Only selected sources will be allowed.
Is my device still be protected by Firewalla security protection?
Yes. Security rules and policy rules always have the highest priority in our system. The allow rules on the local ports will not bypass the security rules.
How to debug when the port still shows closed per external port scan?
- Check if there is another rule blocking the traffic. Learn more about rule logic
- Check if there is double NAT. How to see if you have a public IP address?
- Check if there is any firewall running on your local device.
In the future release, we are going to integrate the option to specify source in the port forwarding UI, so it will be more intuitive and easy to use.