Port Forwarding
Port Forwarding Overview
You can map an external IP address and port with an IP address and port in a private network. This mapping, called port forwarding, is supported on the MS-DPC, MS-100, MS-400, and MS-500 MultiServices PICS. Starting in Junos OS Release 17.4R1, port forwarding is also supported on the MS-MPC and MS-MIC.
Port forwarding allows the destination address and port of a packet to be changed to reach the correct host in a Network Address Translation (NAT) gateway. The translation facilitates reaching a host within a masqueraded, typically private, network, based on the port number on which the packet was received from the originating host. An example of this type of destination is the host of a public HTTP server within a private network. You can also configure port forwarding without translating a destination address. Port forwarding supports endpoint-independent mapping (EIM), endpoint-independent filltering (EIF), and address pooling paired (APP).
Port forwarding works only with the FTP application-level gateway
(ALG), and has no support for technologies that offer IPv6 services
over IPv4 infrastructure, such as IPv6 rapid deployment (6rd) and
dual-stack lite (DS-Lite). Port forwarding supports only dnat-44 and twice-napt-44 on IPv4 networks.
Benefits of Port Forwarding
Allows remote computers, such as public machines on the Internet, to connect to a non-standard port of a specific computer that is hidden within a private network.
Configuring Port Forwarding for Static Destination Address Translation
You can configure destination address translation with port forwarding. Port forwarding allows the destination address and port of a packet to be changed to reach the correct host in a Network Address Translation (NAT) gateway. Port forwarding is supported on the MS-DPC, MS-100, MS-400, and MS-500 MultiServices PICS. Starting in Junos OS Release 17.4R1, port forwarding is also supported on the MS-MPC and MS-MIC.
To configure destination address translation with port forwarding:
A similar configuration is possible with twice NAT for IPv4. See Example: Configuring Port Forwarding with Twice NAT.
Port forwarding and stateful firewall can be configured together. Stateful firewall has precedence over port forwarding.
Configuring Port Forwarding Without Destination Address Translation
You can configure port forwarding without translating a destination address. Port forwarding allows the destination port to be changed to reach the correct port in a Network Address Translation (NAT) gateway. Port forwarding is supported on the MS-DPC, MS-100, MS-400, and MS-500 MultiServices PICS. Starting in Junos OS Release 17.4R1, port forwarding is also supported on the MS-MPC and MS-MIC.
To configure port forwarding without destination address translation in IPv4 networks:
Port forwarding and stateful firewall can be configured together. Stateful firewall has precedence over port forwarding.
Example: Configuring Port Forwarding with Twice NAT
The following example configures port forwarding with twice-napt-44 as the translation type. The example also has stateful firewall
and multiple port maps configured.
Port forwarding is supported on the MS-DPC, MS-100, MS-400, and MS-500 MultiServices PICS. Starting in Junos OS Release 17.4R1, port forwarding is also supported on the MS-MPC and MS-MIC.
[edit services]
user@host# show
service-set in {
syslog {
host local {
services any;
}
}
stateful-firewall-rules r;
nat-rules r;
interface-service {
service-interface sp-10/0/0.0;
}
}
stateful-firewall {
rule r {
match-direction input;
term t {
from {
destination-port {
range low 20 high 5000;
}
}
then {
reject;
}
}
}
}
nat {
pool x {
address 203.0.113.2/32;
}
rule r {
match-direction input;
term t {
from {
destination-address {
198.51.100.2/32;
}
destination-port {
range low 10 high 20000;
}
}
then {
port-forwarding-mappings y;
translated {
destination-pool x;
translation-type {
twice-napt-44;
}
}
}
}
}
port-forwarding y {
destined-port 45;
translated-port 23;
destined-port 55;
translated-port 33;
destined-port 65;
translated-port 43;
}
}
adaptive-services-pics {
traceoptions {
file sp-trace;
flag all;
}
}
Stateful firewall has precedence over port forwarding. In this example, for instance, no traffic destined to any port between 20 and 5000 will be translated.
Up to 32 port maps can be configured.
Change History Table
Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.