Tutorials · Routing & Internet
How to Use NAT and Port Forwarding Safely
Understand source NAT, destination NAT and port forwarding, when to use them, and how to publish a service without exposing your network.
Before you start
- A gateway or firewall
- A public IP address
Step by step
Understand source NAT
Source NAT (masquerade) lets private addresses reach the Internet using the public IP. It is enabled on almost every Internet gateway by default.
Ask whether you need port forwarding at all
Most remote-access needs (CCTV, RDP, device management) should use a VPN instead. Forward ports only for real public services such as a web or mail server.
Put published servers in a DMZ
Place Internet-facing servers in their own VLAN with firewall rules that block access from the DMZ to internal networks.
Create the forward with limits
Forward only the exact port, to one server, and restrict source IPs if the service is for partners only.
ip nat inside source static tcp 10.50.0.10 443 <public-ip> 443Harden the server
Patch it, use TLS, enable logging and protect logins with rate limiting and 2FA.
Disable UPnP
UPnP lets devices open ports automatically. Turn it off on business gateways.
Review forwards quarterly
Delete forwards nobody uses and scan your public IP to see what is exposed.
Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.
Pro tips
- Never forward ports for camera, NVR or switch management pages.
- Use a reverse proxy to publish several web services on one IP safely.
FAQ
Frequently asked questions
Is port forwarding dangerous?
It exposes the forwarded service to the whole Internet. Only forward hardened services that must be public.
Keep learning
Related guides
Firewall rules
Read more →Access CCTV without port forwarding
Read more →How to Set Up Dual-WAN Failover With a 4G LTE Backup
Keep a branch online when the fibre fails: add a 4G LTE link as a backup WAN with health checks and automatic failover.
Read more →How to Plan IP Addressing and Subnets for a Business Network
A clean IP plan makes networks easier to secure, troubleshoot and grow. Learn a simple scheme you can reuse on every site.
Read more →How to Configure DHCP Scopes, Reservations and Options
Hand out addresses reliably: one scope per VLAN, reservations for printers and cameras, the right DNS and gateway options and sensible lease times.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.