Restrict the source
Prefer one maintained administration network, managed access layer, or authenticated VPN path over every public address.
Port Forwarding Planner
Document a proposed public-to-private service mapping before touching the router. The planner validates the ports and internal address, flags broad or high-risk exposure, and creates a review record with a removal path.
The planner runs locally and does not test or configure your router. Use example values on a shared device.
Internet sourceRouter mappingInternal service
Define one accountable mapping
Record the public listener, exact internal destination, allowed source, service owner, review date, rollback, and outside verification before enabling access.
A port forward exposes the router's public boundary, not just the private destination.
Check the path on both sides of the router
The public result depends on address translation, upstream filtering, router policy, the internal route, the host firewall, and the listening application. A correct mapping can still lead to a closed, filtered, or unsafe service.
Harden the destination
Confirm current software, strong authentication, encrypted transport, useful logs, and a listener bound only where required.
Remove what is temporary
Set an expiry and preserve the exact rollback. Turning off the application without removing the mapping leaves unexplained policy behind.
Verify from the correct network position
Test from outside the local network after approval and implementation. Local hairpin behavior may make the public name work or fail differently from a real internet source. Check the expected allowed source and a source that must remain blocked, then preserve the matching router and host evidence.
Check for upstream address translation
Compare the router's WAN address with the public address observed by an external service. If they differ, carrier-grade NAT, another gateway, or a cloud edge may control the public path. A local mapping cannot create inbound reachability through an upstream device you do not administer.
Compare exposure choices before creating the mapping
| Requirement | Usually safer starting point | Question to answer |
|---|---|---|
| Administration by a small known group | Authenticated VPN or managed access gateway | Can the service stay unreachable from the general internet? |
| Public website | Maintained reverse proxy or hosted edge | Who patches, monitors, authenticates, and removes the listener? |
| Temporary vendor support | Time-limited access from fixed sources | Who owns expiry and verifies removal? |
| Consumer device with no maintained security path | No public exposure | Can the task use an outbound connection or supported cloud relay? |
- Record the destination device and support state in the network inventory builder.
- Restrict source addresses and preserve an independent recovery route.
- Confirm that automatic discovery features did not create a second mapping.
- Remove both the mapping and unnecessary listener when the requirement ends.
Investigate before opening a service
Use the port reference to identify the registered service clue and the limited public port scanner to observe selected TCP reachability from FirewallGuide's server. For a complete authorization and evidence plan, use the firewall testing guide.
NIST firewall policy guidance is available in SP 800-41 Rev. 1. A generated record is not approval or a deployed security control.