Required configuration items
- The network interface for the rule.
Network connections will only be forwarded if their destination address matches the IP address of the selected network interface.
- The public-facing port number that network connections must use for their traffic to be forwarded.
- The IP address of the server to which traffic should be forwarded.
- The port or range of ports to which traffic should be forwarded.
Additional configuration items
- A label for the port forwarding rule.
- The IP version (either IPv4 or IPv6) that incoming network connections must match.
- The protocols that incoming network connections must match.
- A white list of devices, based on either IP address or firewall zone, that are authorized to leverage this forwarding rule.
To configure a port forwarding rule:
WebUI
- Log into the 6310-DX WebUI as a user with full Admin access rights.
- On the menu, click System. Under Configuration, click Device Configuration.
- Click Firewall > Port forwarding.
- For Add port forward, click .
The port forwarding rule configuration window is displayed.
Port forwarding rules are enabled by default. To disable, click to toggle off Enable.
- (Optional) Type a Label that will be used to identify the rule.
- For Interface, select the network interface for the rule.
Network connections will only be forwarded if their destination address matches the IP address of the selected network interface.
- For IP version, select either IPv4 or IPv6.
Network connections will only be forwarded if they match the selected IP version.
- For Protocol, select the type of internet protocol.
Network connections will only be forwarded if they match the selected protocol.
- For Incoming port(s), type the public-facing port number that network connections must use for their traffic to be forwarded.
- For To Address, type the IP address of the server to which traffic should be forwarded.
- For Destination Port(s), type the port number, comma-separated list of port numbers, or range of port numbers on the server to which traffic should be forwarded. For example, to forward traffic to ports one, three, and five through ten, enter: 1, 3, 5-10.
-
(Optional) Click Access control list to create a white list of devices that are authorized to leverage this forwarding rule, based on either the IP address or firewall zone:
- To white list IP addresses:
- Click Addresses.
- For Add Address, enter an IP address and click .
- Repeat for each additional IP address that should be white listed.
- To specify firewall zones for white listing:
- Click Zones.
- For Add zone, click .
- For Zone, select the appropriate zone.
- Repeat for each additional zone.
- To white list IP addresses:
- Click Apply to save the configuration and apply the change.
The Configuration window is displayed.
Command line
- Log into the 6310-DX command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
- At the command line, type config to enter configuration mode:
> config (config)>
- At the config prompt, type:
(config)> add firewall dnat end (config firewall dnat 0)>
Port forwarding rules are enabled by default. To disable the rule:
(config firewall dnat 0)> enable false (config firewall dnat 0)>
- Set the network interface for the rule.
(config firewall dnat 0)> interface (config firewall dnat 0)>
Network connections will only be forwarded if their destination address matches the IP address of this network interface.
-
Use the ? to determine available interfaces:
(config firewall dnat 0)> interface ? Interface: Network connections will only be forwarded if their destination address matches the IP address of this network interface. Format: defaultip defaultlinklocal lan loopback modem wan Current value: (config firewall dnat 0)> interface
- Set the interface. For example:
(config firewall dnat 0)> interface wan (config firewall dnat 0)>
- Set the IP version. Allowed values are ipv4 and ipv6. The default is ipv4.
(config firewall dnat 0)> ip_version ipv6 (config firewall dnat 0)>
- Set the public-facing port number that network connections must use for their traffic to be forwarded.
(config firewall dnat 0)> port port (config firewall dnat 0)>
- Set the type of internet protocol .
(config firewall dnat 0)> protocol value (config firewall dnat 0)>
Network connections will only be forwarded if they match the selected protocol. Allowed values are custom, tcp, tcpudp, or upd. The default is tcp.
- Set the IP address of the server to which traffic should be forwarded:
- For IPv4 addresses:
(config firewall dnat 0)> to_address ip-address (config firewall dnat 0)>
- For IPv6 addresses:
(config firewall dnat 0)> to_address6 ip-address (config firewall dnat 0)>
- For IPv4 addresses:
- Set the public-facing port number(s) that network connections must use for their traffic to be forwarded.
(config firewall dnat 0)> to_port value (config firewall dnat 0)>
where value is the port number, comma-separated list of port numbers, or range of port numbers on the server to which traffic should be forwarded. For example, to forward traffic to ports one, three, and five through ten, enter 1, 3, 5-10.
-
(Optional) To create a white list of devices that are authorized to leverage this forwarding rule, based on either the IP address or firewall zone, change to the acl node:
(config firewall dnat 0)> acl (config firewall dnat 0 acl)>
- To white list an IP address:
- For IPv4 addresses:
(config firewall dnat 0 acl> add address end ip-address (config firewall dnat 0 acl)>
- For IPv6 addresses:
(config firewall dnat 0 acl> add address6 end ip-address (config firewall dnat 0 acl)>
Repeat for each appropriate IP address.
- For IPv4 addresses:
- To specify the firewall zone for white listing:
(config firewall dnat 0 acl)> add zone end zone
Repeat for each appropriate zone.
To view a list of available zones:(config firewall dnat 0 acl)> .. .. .. zone ? Zones: A list of groups of network interfaces that can be referred to by packet filtering rules and access control lists. Additional Configuration ------------------------------------------------------------------------------ any dynamic_routes edge external internal ipsec loopback setup (config firewall dnat 0 acl)>
- To white list an IP address:
- Save the configuration and apply the change:
(config)> save Configuration saved. > - Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.
PDF
