Kernaali ToolsEstablish whether inbound IPv4 can reach you
Compare the gateway’s WAN address with the public address observed from the same WAN. RFC 1918 addresses or 100.64.0.0/10 on the WAN indicate private/shared upstream addressing. If an upstream router is yours, both layers need a deliberate forwarding design or an appropriate bridge setup. If it is ISP CGNAT, request inbound-capable service or use an outbound-established VPN solution.
DDNS tracks a changing public address; it does not bypass CGNAT. A public address alone does not prove the ISP permits inbound traffic. Keep multi-WAN selection in mind when comparing observed addresses.
Prove the internal service first
Give the server a stable internal address, preferably a DHCP reservation or a static address outside the pool. Verify its listener and host firewall from an authorized local client. Use the LAN gateway as the return path unless you have deliberately designed another route. Avoid publishing device administration; a VPN is usually the better management path.
Define one narrow mapping
| Setting | Original example | Review |
|---|---|---|
| Incoming WAN | The WAN with the intended public address | Multi-WAN rules need the correct interface |
| Allowed source | A specified administrator public IP | Prefer specified sources to Any |
| External port | 8443/TCP | Only the required transport |
| Forward IP | 10.42.30.20 | Stable internal service address |
| Forward port | 443/TCP | Actual local listener |
| Purpose | Restricted HTTPS service | Authentication and patching still required |
UniFi’s current port-forward feature accepts all incoming sources or specified source IP addresses. Use the restricted option when the use case permits it. Do not select TCP and UDP together unless the service needs both. Documentation addresses such as 198.51.100.44 are suitable for planning examples, not real allowed-source values.
Inspect the effective firewall policy after creating the forward. UniFi can generate associated policies; an earlier custom rule can still block traffic or broaden access unintentionally. Port translation and application authorization remain separate controls.
Verify from an actual external client
Test public-address:8443 from the permitted source, using the real service protocol. A test from the LAN may depend on NAT loopback and is not sufficient evidence of external reachability. Check that a non-permitted source fails. Recheck after the server lease renews or the public address changes.
| Observed result | Investigate next |
|---|---|
| No packets reach the gateway | Wrong WAN/address, ISP filter or upstream NAT |
| Gateway sees traffic, server does not | Forward target, protocol and effective firewall order |
| Server sees request, no reply at client | Host firewall, listener and return route |
| TCP connects, application fails | TLS name/certificate, authentication or application configuration |
| LAN test works, remote fails | Public-IP and source-restriction assumptions |
Remove access when the task ends
Delete or disable the unused forward and verify it no longer accepts a new external session. Recheck the remaining policy if you also made manual exceptions. Keep a record of the destination, owner and reason for each published service.
Identify RFC 1918 and CGNAT · Review zone rules · Check transport choices
These guides use the current UniFi Network concepts. Menu wording and location vary by release; check the policy’s actual scope and result. Kernaali Tools is not affiliated with Ubiquiti.
Technical references
Found an issue? Send a correction with a reproducible example.