The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Port forwarding fails when one of four separate pieces is missing: the internal service is not listening, Linux is not forwarding packets, UFW rejects the forwarded flow, or the NAT rule never matches (or replies take a different route back). A DNAT rule changes a packet’s destination; it does not grant permission through the FORWARD path.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Work from the inside out. Verify the service and its local firewall, verify interfaces and routes, enable kernel forwarding, add a scoped UFW route rule, then inspect DNAT matches, FORWARD counters and packet captures on both interfaces. Test from a genuinely external network unless you have deliberately configured hairpin NAT.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUnderstand what is being forwarded
There are two different classes of traffic in UFW. Traffic addressed to the firewall itself uses ordinary input rules. Traffic that arrives on one interface and must leave through another is routed traffic, so UFW requires the route form of a rule. Ubuntu’s UFW documentation states that rules for traffic “not destined for the host itself” should specify the route keyword, and that routing rules and policy must be accompanied by IP forwarding.
A typical Internet-to-LAN flow is processed in this order:
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
- The packet arrives on the public interface.
- A rule in the NAT table’s
PREROUTINGchain may perform destination NAT (DNAT), changing the public address and port to an internal address and port. - Because the destination is now another host, the packet follows the filter table’s
FORWARDchain rather than the firewall’s local-input path. - If forwarding is permitted, the packet leaves through the LAN interface.
- The internal host replies. Its return route must send that reply through the forwarding machine, or the gateway may need narrowly scoped source NAT/masquerading.
This explains the common symptom “DNAT works but the connection still fails”: NAT translation and forwarding permission are independent decisions.
Before changing rules, prove the service works
Check the listener on the target host
On the internal server, confirm that the application is listening on the expected address and port. A listener bound only to 127.0.0.1, for example, cannot accept connections arriving on the LAN address.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo ss -lntupCheck the intended protocol and address, then test the service from another host on the same internal network using the server’s private address. If that test fails, port forwarding is not yet the problem: start or reconfigure the service first.
Check the target host’s own firewall
The internal machine can still reject a packet after the gateway forwards it. Permit the service’s TCP or UDP port on the target host’s local firewall, limited to the required source networks where practical. Confirm the application is actually using the port you plan to publish; forwarding TCP 8080 to an HTTP service on TCP 80 requires an explicit port translation.
Verify the gateway’s interfaces and routes
Identify the public (WAN) and internal (LAN) interfaces on the forwarding host and confirm that the target subnet is reachable through the LAN interface.
ip -br address
ip routeThe gateway must have an address on the public side, an address on the internal side, and a route to the target host or subnet. An interface-name typo in a UFW route rule or a DNAT match can produce a completely silent failure.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Check the target host’s default gateway as well. If it points somewhere other than the forwarding machine, replies may bypass the gateway and never reach the original client. Correct the internal routing, or use narrowly scoped masquerading when changing the internal route is not possible. Do not treat DNAT alone as a fix for asymmetric return traffic.
Enable kernel forwarding
IPv4
Inspect the current setting:
sysctl net.ipv4.ip_forwardA value of 0 prevents the Linux kernel from routing IPv4 packets even when NAT and firewall rules are correct. Set it to 1 using the sysctl configuration used by your Ubuntu deployment, then apply the setting. UFW also documents forwarding-related sysctl values; use those documented values rather than assuming a filter rule can enable forwarding by itself.
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl --systemThe first command changes the running system. The second reapplies values from the system’s sysctl configuration files, so ensure the persistent file contains the value you intend before relying on a reboot.
IPv6
IPv6 forwarding is controlled separately from IPv4. If the published service uses IPv6, inspect the relevant IPv6 forwarding tunables and enable them in the same persistent sysctl workflow. An IPv4-only setting does not make an IPv6 flow routable, and an IPv6 client may therefore fail while IPv4 testing succeeds.
Set UFW’s forwarding policy and add a scoped route rule
Inspect the default policy
Ubuntu separates the default forwarding policy in /etc/default/ufw from individual route rules. Inspect the DEFAULT_FORWARD_POLICY value and determine whether it permits or denies forwarded traffic by default. A restrictive default is often preferable, but it means every intended path needs an explicit allow rule.
grep '^DEFAULT_FORWARD_POLICY' /etc/default/ufw
sudo ufw status verboseChanging a default policy affects more traffic than one published service. If you change it, review the resulting exposure and reload UFW during a maintenance window.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Add the route permission
For a TCP service on internal host 192.0.2.10, reachable from eth0 (WAN) through eth1 (LAN) on port 80, a scoped rule is:
sudo ufw route allow in on eth0 out on eth1 to 192.0.2.10 port 80 proto tcpAdapt the interfaces, address, port and protocol to your deployment. This is not the same as ufw allow 80/tcp: the latter authorizes traffic addressed to the firewall itself, while the route rule authorizes a forwarded path.
After modifying UFW configuration or rule files, reload it and verify the active rules:
sudo ufw reload
sudo ufw status numberedAdd and persist DNAT when the public address must be translated
If clients connect to the gateway’s public address but the application lives on an internal host, add destination NAT in the NAT table. Ubuntu documents UFW’s rule-file workflow: custom NAT entries commonly go in /etc/ufw/before.rules, before the filter-table section, and must be reloaded after editing. Follow the file’s existing table structure; do not paste a second, malformed table header into an unrelated section.
The following is a conceptual IPv4 rule that translates TCP port 8080 arriving on eth0 to port 80 on 192.0.2.10:
-A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to-destination 192.0.2.10:80Match the public interface, protocol and destination port deliberately. If the gateway has multiple public addresses, include the intended destination address in the match so an unrelated address is not translated. Persist the rule through the UFW rule-file mechanism rather than relying on an ad-hoc command that disappears at reboot.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
After reloading, inspect the NAT rules:
sudo iptables -t nat -SOn systems using the nftables backend, use the equivalent nftables view for the active ruleset. The important question is whether the expected PREROUTING rule is loaded and can count packets.
Use counters to separate NAT failures from filter failures
Generate one connection attempt while watching counters. A DNAT rule that receives no packets points to a mismatch or an arrival problem: wrong interface, public address, protocol, port, or an edit that was never loaded. A DNAT hit followed by no increase in the corresponding FORWARD rule indicates that filtering or forwarding policy is stopping the translated packet.
sudo iptables -t nat -L PREROUTING -n -v
sudo iptables -L FORWARD -n -vUse the active backend’s equivalent commands if iptables is a compatibility frontend. Read counters immediately after a single test so unrelated traffic does not obscure the result. Also inspect UFW’s verbose status and logs when logging is enabled; a logged drop can identify the interface and destination that the rule missed.
Capture both sides of the gateway
Packet captures show where the flow stops more reliably than a client timeout. On the WAN interface, watch for the incoming connection:
sudo tcpdump -ni eth0 'tcp port 8080'On the LAN interface, watch for the translated service port:
sudo tcpdump -ni eth1 'host 192.0.2.10 and tcp port 80'Replace interface names and ports with your values. Interpret the results as a decision tree:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
- No packet on WAN: the client is using the wrong address, the upstream network is filtering it, or the test is not actually external.
- Packet on WAN but none on LAN: the DNAT rule did not match, forwarding is disabled, or the
FORWARDpath dropped it. - Packet leaves on LAN but the target does not answer: check the target service, target-host firewall and address/port translation.
- Target replies appear on LAN but never reach WAN: inspect the target’s default route, reverse-path filtering and any required source NAT.
- A complete handshake occurs but the application fails: investigate the application protocol, advertised addresses and separate data channels; basic port translation only covers the flow you matched.
Test from a real external network
An internal client that connects to the gateway’s public address is testing hairpin (NAT loopback) behavior, not ordinary Internet-to-LAN forwarding. Hairpin NAT requires additional design and may fail even while outside clients work. Test first from a host on a different network, such as a separate Internet connection. If external testing succeeds but an internal public-address test fails, decide whether to configure hairpin NAT or have internal clients use the private address or internal DNS.
UFW-only routing versus custom DNAT
| Design | When it fits | Where permission is defined | Address translation | Return-path concern | Inspection |
|---|---|---|---|---|---|
| UFW route rule | The host routes traffic and the destination addressing is already appropriate for the path | UFW route rules and the forwarding policy in /etc/default/ufw |
None unless another component performs NAT | The destination must route replies back through the gateway | ufw status plus FORWARD counters and captures |
| UFW plus custom DNAT | Clients use a public gateway address or port that must map to an internal service | UFW route permission plus custom NAT in the UFW rule-file workflow | PREROUTING rewrites the destination address and possibly port |
Still requires a valid return route; narrowly scoped masquerading may be needed | NAT counters, FORWARD counters, UFW status and captures |
Both designs still depend on kernel forwarding. DNAT does not replace a route permission, and a permissive default policy does not repair a missing NAT match.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common failure patterns and precise fixes
“I used ufw allow, but forwarding is blocked”
Replace the host-input rule with a route rule that names the ingress interface, egress interface, destination and protocol. Confirm the default forwarding policy does not override the intended path.
“The NAT rule is present, but counters stay at zero”
Compare the attempted packet with every match condition: public interface, destination address, protocol and port. Confirm the edited UFW rule file was loaded with sudo ufw reload. Capture on the WAN interface to verify that traffic reaches this gateway at all.
“The first packet arrives, but the connection times out”
Check the FORWARD counters and the target host’s firewall. A translated packet still traverses the filter path. If the request reaches the server and the reply leaves by another gateway, correct routing or apply narrowly scoped masquerading as part of the gateway design.
“It works externally but not from inside”
This is usually hairpin NAT behavior, not evidence that ordinary port forwarding is broken. Use internal addressing or DNS, or implement and test a deliberate loopback design.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →“IPv4 works and IPv6 fails”
Check IPv6 forwarding tunables, IPv6 firewall policy and whether the service is listening on an IPv6 address. IPv4’s net.ipv4.ip_forward setting has no effect on IPv6 forwarding.
Safe change and verification checklist
- Record the intended public address, public port, internal address, internal port, protocol and interface names.
- Verify the service listens on the internal address and works from an internal peer.
- Permit the service on the target host’s local firewall.
- Confirm the gateway has a route to the target subnet and the target’s reply route returns through the gateway.
- Enable and persist the correct IPv4 and, when applicable, IPv6 forwarding settings.
- Inspect
DEFAULT_FORWARD_POLICYand add the narrowest UFWrouterule. - Place custom DNAT in the documented UFW rule-file workflow when translation is required, then reload UFW.
- Check NAT and
FORWARDcounters during one controlled connection attempt. - Capture WAN and LAN traffic to identify the exact point of failure.
- Retest from an external network and separately decide whether hairpin access is needed.
Keep published services restricted to the required protocol, port and destination. Avoid changing the global forwarding policy merely to make one test pass; a narrow route rule is easier to audit and less likely to expose unrelated internal hosts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
