How you can Set Up Port Forwarding in UniFi — LazyAdmin

Port forwarding on a UniFi gateway was simple to search out. However since Community 9.3, it has moved round a bit to now land within the Coverage Engine, which isn’t essentially the most clear a part of the community settings.

Establishing the port forwarding in UniFi itself continues to be fairly easy. You choose a WAN interace, level it to a tool in your community, and UniFi creates the firewall rule for you. However usually there may be extra wanted then that alone.

On this article, we’ll take a look at the place to search out port forwarding within the totally different UniFi Community variations, configure every subject, and check and troubleshoot it. I’m utilizing Plex as the instance, however the steps are the identical for any service, on any UniFi (UBNT) gateway.

Earlier than You Begin

There are two belongings you need to test earlier than you create the forwarding rule. If one among them isn’t proper, the port ahead is rarely going to work, irrespective of the way you configure it.

Examine Public IP Tackle

Port forwarding solely works in case your UniFi gateway has a public IPv4 handle on its WAN interface. In case your ISP makes use of CGNAT (Service‑Grade NAT), or there may be one other router in entrance of your gateway, the site visitors by no means reaches UniFi.

Checking this solely takes a number of seconds:

1. Open the UniFi Community utility
2. On the dashboard you will notice your WAN IPv4 Tackle
3. From a tool in your community, open ifconfig.me

If each addresses match, you may have a public IP and you’ll skip to the following part. In the event that they don’t match, evaluate the WAN IP with the ranges under:

With CGNAT, your public IP is shared with different clients of your ISP. Port forwarding can’t work round that. The one actual repair is asking your ISP for a public IP handle. Some ISPs do that at no cost, others cost a small payment.

With double NAT, the ISP router continues to be doing the routing. The very best repair is to place the ISP router in bridge mode, so your UniFi gateway will get the general public IP instantly. In case your ISP router doesn’t help bridge mode, you have to to ahead the port on the ISP router to the WAN IP of your UniFi gateway as properly, or level the DMZ possibility of the ISP router to your UniFi gateway.

Additionally needless to say most dwelling connections don’t have a static public IP. It might change after a modem restart or a lease renewal. A greater possibility then is to make use of area title as a substitute of IP, and arrange dynamic DNS in UniFi first.

Give the Gadget a Mounted IP Tackle

The port is forwarded to an inside IP handle of your gadget. The issue, in case your server will get a brand new IP handle from DHCP, the rule factors to nothing, or worse, to a unique gadget.

Now in UniFi you may solely choose gadgets with a static IP Tackle, so the steps under are obligatory:

1. Open Consumer Gadgets and choose the gadget
2. Go to Settings and open the IP Settings part
3. Allow Mounted IP Tackle and enter the IP handle

I like to recommend to set a Native DNS report for the gadget as properly if you are right here. We’ll come again to this later for the native DNS report.

The place to Discover Port Forwarding in UniFi

If in case you have been utilizing UniFi for some time, that settings like to maneuver round. Port forwarding is an efficient instance. It has modified location in just about each main model of the Community utility:

For this text, I’m utilizing UniFi Community 10.6. If you’re on an older model, the fields are largely the identical, solely the situation is totally different.

How you can Set Up Port Forwarding in UniFi

On this instance, we’re going to make a Plex server reachable from the web. The Plex server listens on port 32400, however we’ll use port 444 on the WAN aspect. Extra about why later.

1. Open the UniFi Community utility and go to Settings
2. Go to Coverage Desk (beneath Coverage Engine)
3. Click on on Create New Coverage
4. Choose Port Forwarding
5. Give the rule a descriptive title, for instance Plex

Subsequent, configure the next fields:

Click on Save to create the rule.

WAN Port vs. Ahead Port

Bots are always scanning the web for default ports, like 3389 for RDP or 32400 for Plex. So utilizing a unique port on the WAN aspect, gained’t make your service safe, however it does cut back a whole lot of the noise in your logs.

So on this instance, site visitors is available in on port 444 and is forwarded to port 32400 on the Plex server.

Each port fields additionally settle for ranges and lists, for instance 1-10,11,12. Helpful for sport servers or VoIP, which regularly want an entire vary of ports.

Observe

A WAN port can solely be forwarded to 1 gadget. So if port 444 is already forwarded to your Plex server, you may’t ahead it to a different gadget as properly. You possibly can, nevertheless, ahead a number of WAN ports to the identical inside port.

Limit the Supply and Protocol

Two fields that the majority ignore are the From and Protocol, however each are literally fairly essential on the subject of safety.

If solely you want entry, out of your workplace for instance, then set From to Restricted, and enter the general public IP handle of your Workplace community. Everybody else will get dropped earlier than they even attain your service.

The identical goes for the protocol. Solely choose Each if the service truly wants TCP and UDP. Plex, on this instance, solely wants TCP.

The Firewall Rule Is Created Mechanically

With the zone-based firewall, UniFi creates the firewall rule for you. You don’t want so as to add an enable rule your self, and also you positively shouldn’t add a second one.

You will discover the rule beneath Exterior → Inner within the zone matrix (or the zone the place your gadget is situated). It’s named after your port ahead, on this case Enable Port Ahead Plex:

The rule is locked, so you may’t edit it. If you wish to change one thing, you alter the port ahead rule, and UniFi updates the firewall rule for you.

That is additionally why the From and Protocol fields are essential. You all the time need to restrict the publicity of your community as a lot as attainable.

If you wish to be taught extra about how the zones work, learn the article in regards to the UniFi zone-based firewall.

Configure Plex Distant Entry

Plex doesn’t really want port forwarding to work exterior your community. With out it, Plex falls again to its relay service. However the relay is bandwidth-limited, so you might be caught with low-quality streams. That’s the explanation most individuals ahead the port.

As a result of we’re utilizing a unique WAN port, we have to inform Plex which public port to make use of:

1. Open Plex and go to Settings > Distant Entry
2. Click on on Present Superior
3. Allow Manually specify public port and enter 444
4. Click on Apply

If every part is configured accurately, Plex reveals the standing Totally accessible exterior your community.

Check the Port Ahead

At all times check the port ahead from exterior your community. The best method is your telephone. Flip off Wi-Fi, so you might be on 4G or 5G, and open http://<your-public-ip>:444, for instance.

You can even use an internet port checker, or test the site visitors in UniFi beneath Insights > Flows. In case you see the connection makes an attempt there, the site visitors is no less than reaching your gateway.

Why It Doesn’t Work From Inside Your Community

Now, while you attempt the identical URL from a tool in your Wi-Fi, it’s not going to work. In my exams on Community 10.6, the port ahead labored positive over 4G, however not from contained in the community.

Connecting to your individual public IP from inside your community is named hairpin NAT (or NAT loopback). And UniFi isn’t doing it right here. Now usually you wouldn’t use your public IP from inside your community, however both the inner IP handle or an area DNS title.

For Plex, this isn’t actually a difficulty, as a result of the Plex apps discover the server on the native community themselves. However for different companies, you desire a title that works each inside and outdoors. You are able to do this with an area DNS report:

1. Open Consumer Gadgets and choose the gadget
2. Go to Settings and open the IP Settings part
3. Allow Native DNS Report and enter a reputation, for instance plex

Gadgets in your community can now attain the server by its title, with out going by the general public IP.

Port Forwarding Not Working?

If the port ahead doesn’t work from exterior, undergo the listing under. It’s so as of what I discover most probably, so begin on the high.

No Public IP Tackle

That is the commonest trigger by far. Examine the WAN IP as defined in Earlier than You Begin. In case your gateway has an handle in one of many CGNAT or personal ranges, nothing else on this listing issues.

You might be Testing from Inside Your Community

As we simply noticed, that gained’t work. Flip off Wi-Fi in your telephone and check once more.

The Firewall on the Gadget Is Blocking the Port

The port ahead and the UniFi firewall rule may be excellent, and the connection nonetheless fails as a result of the gadget itself drops it. Examine Home windows Defender Firewall on Home windows, or ufw or iptables on Linux. Host firewalls usually solely enable connections from the native subnet.

The Service Isn’t Listening

Ensure that the service is definitely operating and listening on the port you ahead to. From one other pc in your community, you may check this with PowerShell:

Check-NetConnection -ComputerName 172.16.1.221 -Port 32400

If TcpTestSucceeded returns False, the issue is on the gadget, not in UniFi. On Linux, you may test which ports are listening with ss -tlnp.

Ought to You Use Port Forwarding?

For one thing like Plex, a sport server, or a reverse proxy on port 443, port forwarding is an inexpensive selection. However each port you open is uncovered to the entire web. Open Insights > Flows a number of hours after making a port ahead, and you will notice how shortly the scanners discover it.

So a few guidelines I’d stick with:

• Use a VPN on your personal entry.
  If you’re the one one who wants to achieve a service, use WireGuard or Teleport, each constructed into your UniFi gateway. No open ports wanted for the service itself.
• By no means expose administration interfaces.
  RDP, SMB, your NAS admin web page, or the UniFi console itself ought to by no means be reachable by a port ahead.
• Put uncovered gadgets in a separate community.
  If the gadget will get compromised, you don’t need the attacker on the identical community as your laptops and NAS. Place it in its personal VLAN and zone.
• Disable UPnP.
  It permits any gadget in your community to open ports with out you realizing about it. Plex will attempt to use it as properly, which is why we configured the port manually.
• Limit the supply the place you may.
  If who’s connecting, set the From subject.

Wrapping Up

Port forwarding in UniFi isn’t onerous, it’s simply more durable to search out than it was. And with each main model, the situation appears to alter once more. However the computerized firewall rule is an actual enchancment. You possibly can’t neglect it anymore, and it follows no matter you configure within the port ahead.

In case your port ahead doesn’t work, the issue is often not in UniFi. Examine your WAN IP first, check from exterior your community, and test the firewall on the gadget itself. That covers just about each case I’ve seen.

I hope you appreciated this text, in case you have any questions, simply drop a remark under.