Port forwarding is a process consisting in the translation of a host:port couple into another host2:port2 couple, both submitted to the same network mask.

Forwarding a port is the process of setting a translation from port A to port B, over two IP addresses (eventually, the same host). This is generally used to open a local area network to the Internet, through its network gateway. This allows hosts from the WAN to connect services from a LAN, hidden behind their router.

Port forwarding tables

Port forwarding settings are usually gathered into a forwarding table, saved by the network gateway/router. This table contains the following parameters from each forwarding rule :

  • Source host : receives the packets and forwards them, usually the router.
  • Destination host : new destination set for packets while forwarding.
  • Source port : port opened and dedicated to packets forwarding on the source host.
  • Destination port : port listening on the local host, and processing the forwarded packets.

On some more recent hardware, it is possible to set rules for a range of ports, and not for a unique port. This allows the translation from ports A to N to the same ports on the local host receiving the forwarded packets. This is useful if your processing application requires several (and consecutive) ports to work.

Example : HTTP forwarding

Consider the following wireless network :

  • Router is located on, and available on the Internet through IP
  • The web server is located on and listens on ports 80 (HTTP) and 443 (HTTPs).

In this case, the forwarding consists in the translation from (available from the WAN) to (available from the LAN only). This configuration takes place on the forwarding host, i.e. the router on When receiving packets on port 80, it'll automatically forward them to, which will process the HTTP request, and send its response through the same but opposite network route (web server - router - client). Once this configuration is complete, it becomes possible to access the local web server from the WAN, by requesting

An identical configuration would also be made, translating to