NAT port forward not working
A port forward is a destination-NAT rule: traffic to the router's public IP on one port gets rewritten to an inside host and port. When it 'doesn't work', the packet is being lost at one specific step: the DNAT rule, the routing back, the host's own listener, or a firewall in front of it. Find which step, don't guess.
What it means
Inbound DNAT rewrites the destination of packets hitting `public-ip:port` to `inside-ip:port` before routing. For a reply to get home, the return traffic must be un-NAT'd along the same path, so the inside host's default route has to point back through the NAT router. Any break in that chain looks like 'port forward not working'.
Most common causes
- DNAT rule missing or wrong port. No prerouting/static NAT rule for that public port, or it forwards a different port than the service listens on. Only the one published port should be forwarded.
- No return path through the NAT router. The inside server's traffic must leave via the same router that did the NAT. If its default gateway points elsewhere, replies bypass the un-NAT and the client never sees them.
- Server isn't actually listening. The forward is fine but the inside service is down or bound to localhost only. Confirm it's listening on the right address and port first.
- Firewall dropping the forwarded connection. A forward chain or host firewall that default-drops will kill the new connection even with DNAT in place. The forwarded port has to be permitted.
How to fix it
- Confirm the inside server is listening on the expected port (from the server itself).
- Add or correct the DNAT rule: `public-ip:port` → `inside-ip:port`, scoped to that one port.
- Check the inside host routes its replies back through the NAT router.
- Make sure the firewall permits the forwarded port (forward chain / host rules).
- Test from the outside client against the public IP and port.