Port forwarding is a process consisting in the translation of a host:port couple into another host2:port2 couple, both submitted to the same network mask.
Forwarding a port is the process of setting a translation from port A to port B, over two IP addresses (eventually, the same host). This is generally used to open a local area network to the Internet, through its network gateway. This allows hosts from the WAN to connect services from a LAN, hidden behind their router.
Port forwarding tables
Port forwarding settings are usually gathered into a forwarding table, saved by the network gateway/router. This table contains the following parameters from each forwarding rule :
- Source host : receives the packets and forwards them, usually the router.
- Destination host : new destination set for packets while forwarding.
- Source port : port opened and dedicated to packets forwarding on the source host.
- Destination port : port listening on the local host, and processing the forwarded packets.
On some more recent hardware, it is possible to set rules for a range of ports, and not for a unique port. This allows the translation from ports A to N to the same ports on the local host receiving the forwarded packets. This is useful if your processing application requires several (and consecutive) ports to work.
Example : HTTP forwarding
Consider the following wireless network :
- Router is located on 192.168.1.1, and available on the Internet through IP 1.2.3.4.
- The web server is located on 192.168.1.2 and listens on ports 80 (HTTP) and 443 (HTTPs).
In this case, the forwarding consists in the translation from 1.2.3.4:80 (available from the WAN) to 192.168.1.2:80 (available from the LAN only). This configuration takes place on the forwarding host, i.e. the router on 192.168.1.1. When receiving packets on port 80, it'll automatically forward them to 192.168.1.2:80, which will process the HTTP request, and send its response through the same but opposite network route (web server - router - client). Once this configuration is complete, it becomes possible to access the local web server from the WAN, by requesting http://1.2.3.4/
An identical configuration would also be made, translating 1.2.3.4:443 to 192.168.1.2:443.
