Port Forwarding

This doc explains the panel's "Port Forwarding" — traditional port forwarding (iptables/nftables DNAT) on servers with an independent public IP.

One-line understanding

You have a server with a public IP and want it to forward traffic arriving on "some public port" to "another machine (or another port on the same machine)". Port Forwarding is exactly that.

Feature overview

For servers with an independent public IP, you can use the system firewall (iptables/nftables) to forward inbound traffic on "a public port" to "target IP:port". This is traditional, system-level port forwarding.

Difference from Port Tunneling (decide which to use first)

Use cases

• Forward a port on the server's public IP to a service on another server
• Map a non-standard port (e.g. 8888) to a standard service port
• Expose services on private-network machines through a machine with a public IP

Example

You have a public server 1.2.3.4 and a private machine 192.168.1.100 running a web service (port 80). You want outsiders accessing 1.2.3.4:8888 to reach the private port 80:

• Protocol: TCP
• Listen port: 8888
• Target IP: 192.168.1.100
• Target port: 80

How to use

Enter the target server with a public IP, go to "System Panel → Firewall → Port Forwarding", and open "Port Forwarding Management":

1. Click "Add Forwarding" and fill in:

• Protocol: TCP / UDP
• Listen port: the public inbound port
• Target IP: the real address of the forwarding target (public IP or routable private IP)
• Target port: the target service port

2. After creation, traffic is forwarded

3. Created forwardings are shown in a list, and can be edited or deleted

Technical notes (forwarding rules)

The panel automatically configures three rules on the server (using TCP, listen 8888, target 192.168.1.100:80 as an example):

1. DNAT: rewrites traffic to :8888 to 192.168.1.100:80

2. FORWARD allow: allows the forwarded forward/return traffic

3. MASQUERADE: source address translation, so return packets route back correctly

> In plain terms: DNAT "changes the destination", MASQUERADE "changes the return address" — the three rules work together to make forwarding fully effective.

Notes

1. Requires an independent public IP: Port Forwarding is done on the target server itself, which requires it to have an independent public IP (traffic actually hits it).

2. Firewall allow: when forwarding to another server, the target server / intermediate firewall must allow the target port.

3. Edit = delete old rules + create new: system firewall rules don't support in-place modification; editing first deletes the old rules then adds new ones.

4. The panel auto-adapts to iptables-legacy / iptables / nftables backends — no manual selection needed.