The Port forwarding tab holds the firewall's NAT: outbound internet for the whole network, and inbound forwards to a specific workload.
Outbound internet (NAT masquerade)
The Outbound internet (NAT masquerade) switch lets everything on the network reach the internet through the firewall, with no public address of its own. It is on by default.
This is what makes a private-only workload able to fetch packages, call an API or send mail without a public IP. Turn it off only if you want the network to have no managed path to the internet at all.
Port forwards (inbound)
A port forward sends a port on the firewall's public address to a port on a workload inside the network. Select Add forward and fill in:
| Field | What it means |
|---|---|
| Protocol | TCP or UDP |
| Public port | The port on the firewall's public address, 1 to 65535 |
| To address | The workload's address on one of the firewall's private networks |
| To port | The port on the workload |
| Note | Optional, up to 120 characters |
For example, forward TCP 2222 on the public address to 22 on 10.10.0.20
to reach one server's SSH from outside, without giving that server a public
address.
Each public port can be forwarded once per protocol. If you need HTTPS with a certificate and a domain name instead of a raw port, use the load balancer.
A forward still obeys the firewall rules
Inbound traffic is blocked by default. A port forward sends traffic to the right place, but you still need an Allow rule for it if your firewall rules would otherwise block it. The forward decides where; the rules decide whether.