Link Search Menu Expand Document

Inbound Port Forwarding

Configuration > Overlays & Security > Security > Inbound Port Forwarding

Inbound port forwarding allows traffic from the WAN to reach computers or services within a private LAN when you have a stateful firewall. It helps define and manage inbound traffic, remap a destination IP address and port number to an internal host, and create policies to manage branch devices from the WAN. Use this tab to define the desired inbound traffic.

Inbound Port forwarding is available in two modes when you add or edit a rule, depending on whether the translate mode is enabled or disabled.

The first operating mode for inbound port forwarding is when translate mode is disabled with inbound port forwarding. The LAN-side subnet with private IP addresses is allowed access through an inbound port forwarding rule (defined by you in the following steps) and exposes any external services. This requires LAN side private addresses to be routed on the WAN side. This represents the process of DMZ (Demilitarized Zone).

NOTE: This mode is not common unless the port forwarding source is directly connected to the EdgeConnect or if the LAN side device address is routed from the WAN side. Additionally, inbound port forwarding does not support TFTP servers.

To establish a DMZ connection, complete the following steps:

  1. Go to the Inbound Port Forwarding tab.

  2. Select the Edit icon next to Appliance Name.

  3. Select Add Rule.

  4. Complete each field with the appropriate information.

    Field Description
    Source IP/Subnet Source of the WAN device managing the LAN device(s) specified in the destination.
    Destination IP/Subnet Address of the LAN device(s) managed remotely.

The second mode is when translate mode is enabled. When enabled, the EdgeConnect WAN interface performs destination NAT to reach LAN side device(s) from an external network.

Complete the following steps to enable the translate mode. This represents the process of DNAT (Destination Network Translation).

  1. Go to the Inbound Port Forwarding tab.

  2. Select the Edit icon.

  3. Select Add Rule.

  4. Select the Translate check box to enable Translate mode.

  5. Complete each field with the appropriate information.

    Field Description
    Source IP/Subnet Source of the WAN device managing the LAN device(s) specified in the destination.
    Destination IP/Subnet Address of the WAN interface IP.
    Destination Port/Range Port/range of the LAN device(s) that are managed remotely.
    Protocol Select the protocol you want to apply: UDP, TCP, ICMP, Any. If you select Any, the Destination and Translated Ports have a default value that need to be between 0-100. If the value exceeds, 100 a warning appears.
    Translated IP IP address of the LAN device accessed inside your network.
    Translated Port/Range Port/range of the LAN device accessed inside your network.
    Source Interface Source interface name.
    Segment Name of the segment being used.
    Comment Any additional details.

Additional Information

  • Interface Modes

    Port forwarding is used only when you have ‘stateful’ or ‘stateful+snat’ configured on interfaces. It does not apply when you have ‘Allow All’ or ‘Harden’ configured.

  • Security Policies

    *If ‘security policies’ are configured, make sure they allow the traffic specified in the port forwarding rules.

  • You can also reorder the appliances associated with inbound port forwarding by selecting Reorder when adding a rule.

NOTE: ‘Any’ is a protocol option only on versions 8.1.9.4 and later.


Back to top

© Copyright 2022 Hewlett Packard Enterprise Development LP. The information contained herein is subject to change without notice. The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. Aruba Networks and the Aruba logo are registered trademarks of Aruba Networks, Inc. Third-party trademarks mentioned are the property of their respective owners. To view the end-user software agreement, go to Aruba EULA.