UFW port forwarding fails when one part of the packet path is missing: the service is not listening, the kernel is not forwarding, UFW is filtering the FORWARD chain, DNAT does not match, the return route is asymmetric, or the test is being made from inside the network without hairpin NAT. Work through those layers in order. A UFW route rule permits traffic traversing the host; a DNAT rule changes the destination, but the translated packet still has to pass forwarding filters and receive a valid reply.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Understand the packet path before changing rules
Port forwarding is not the same as opening a port on the firewall itself. A connection addressed to the gateway terminates on that host and is evaluated as local input. A forwarded connection arrives on one interface, is translated or routed, leaves through another interface, and is evaluated by the FORWARD path.
As an Amazon Associate I earn from qualifying purchases.
- The client sends a packet to the gateway’s public address and port.
- The gateway receives it on the WAN interface.
- A DNAT rule in the NAT table may rewrite the destination to an internal address and port.
- The kernel must have IP forwarding enabled.
- UFW/iptables must allow the packet through the
FORWARDchain. - The packet must leave through the interface that reaches the internal host.
- The internal service and its local firewall must accept it.
- The reply must return through the gateway, or the gateway must apply suitable source NAT.
Ubuntu’s UFW documentation states that traffic not destined for the host itself should use the route keyword, and that routing rules and policy are not enough without IP forwarding. DNAT only rewrites destination information; it does not bypass filtering or solve an asymmetric return path.
Use this diagnostic sequence
Run the checks in order. Each step eliminates a different failure class, so changing several rules at once makes the result harder to interpret.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- Verify the internal service and its local firewall.
- Verify interfaces, addressing, and a route to the target subnet.
- Verify kernel forwarding, including the correct IP version.
- Verify UFW’s forwarding policy and add a scoped route rule.
- Verify that the DNAT rule is loaded and matches the incoming packet.
- Inspect
FORWARDcounters and logging. - Capture packets on both interfaces.
- Retest from an external network if hairpin NAT is not configured.
1. Confirm that the destination service is actually available
On the internal host, check that the process is listening on the expected address and port. A service bound only to 127.0.0.1, or to a different internal address, cannot receive a forwarded connection. Confirm the protocol as well: a TCP rule does not forward UDP traffic.
Test the service directly from the gateway or another host on the same LAN, using the internal address and port. If that direct test fails, fix the service configuration first. Also inspect the target host’s local firewall. The gateway’s DNAT and UFW rules cannot override a reject or drop on the destination machine.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems2. Check the gateway’s interfaces and routes
Identify the interface receiving the public connection and the interface leading to the internal subnet. The conceptual examples below use eth0 for the WAN side and eth1 for the LAN side; substitute the names shown by your system.
Confirm that the gateway has a route to the target network and that the target address is reachable through the intended interface. A correct DNAT rule with no route to the translated address will never produce a working connection. Check for overlapping subnets, an incorrect VLAN, or a gateway address assigned to the wrong interface.
3. Enable kernel forwarding
Check IPv4 forwarding with:
sysctl net.ipv4.ip_forward
The value must be 1 for an IPv4 gateway. A temporary change is:
sudo sysctl -w net.ipv4.ip_forward=1
For a persistent UFW-managed configuration, place the forwarding value in the UFW sysctl configuration documented for your Ubuntu release, commonly /etc/ufw/sysctl.conf, then reload UFW. Do not assume that enabling IPv4 also enables IPv6. IPv6 has separate forwarding tunables; inspect the relevant net.ipv6 settings when forwarding IPv6 traffic and enable them only when the design requires it.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
After changing the setting, reload UFW and repeat the test. If forwarding is disabled, packets can arrive on the WAN interface and still never traverse the host, regardless of how permissive the NAT rule appears.
4. Check UFW’s forwarding policy and use a route rule
Inspect UFW’s active state and the forwarding policy configured in /etc/default/ufw. Ubuntu documents DEFAULT_FORWARD_POLICY and explicit route rules as separate controls: the policy determines the default treatment of forwarded packets, while a route rule grants a specific flow.
A narrowly scoped permission for TCP port 80 from eth0 to an internal server at 192.0.2.10 is:
sudo ufw route allow in on eth0 out on eth1 to 192.0.2.10 port 80 proto tcp
Adapt the interfaces, address, port, and protocol to your deployment. The route keyword is essential here because the traffic is passing through the firewall rather than terminating on it. A command such as ufw allow 80/tcp addresses local input and does not, by itself, authorize the forwarded path.
After changing UFW rules or its forwarding policy, apply them with:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo ufw reload
Use the narrowest source, destination, interface, protocol, and port scope that meets the requirement. A broad forwarding policy can make troubleshooting appear successful while exposing unrelated internal services.
5. Verify DNAT in the NAT table
Inspect the loaded NAT rules with:
iptables -t nat -S
On systems using an nftables-backed firewall, use the equivalent nftables view for the ruleset actually handling packets. The DNAT entry must match the public-facing interface, protocol, destination port, and any destination-address condition used by your design.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A conceptual IPv4 rule that maps public TCP port 8080 to port 80 on the internal server is:
-A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to-destination 192.0.2.10:80
This is an example to adapt, not a complete firewall policy. A common error is matching the internal port instead of the public port, selecting the wrong interface, or writing a rule that was never loaded after editing. If the public service uses a different internal port, the translated destination must include that port.
6. Inspect the FORWARD chain and counters
DNAT and filtering are separate operations. A packet can match PREROUTING and have its destination rewritten, then be dropped by the FORWARD chain. Examine the forwarding rules and their packet counters. A DNAT rule that increments while the relevant forwarding counter remains at zero strongly indicates a forwarding-policy or filter-rule problem. If the DNAT counter never increments, investigate the incoming interface, public address, protocol, port, rule load, and whether the traffic reached this gateway at all.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Enable targeted logging only while diagnosing, and remove or reduce it afterward to avoid filling logs. Counters are especially useful when several similar rules exist: they show which rule is actually seeing traffic rather than which rule merely looks correct in a file.
7. Capture traffic on both sides
Capture the attempted connection on the WAN interface:
tcpdump -ni <wan> port <public-port>
Capture the corresponding traffic on the LAN interface:
tcpdump -ni <lan> port <internal-port>
Replace the angle-bracket values with real interface names and ports. These captures answer four separate questions: did the request arrive, was it translated, did it leave toward the server, and did a reply return? Seeing packets on WAN but not LAN points to forwarding, route, or DNAT matching. Seeing them on both sides but no reply points to the service, destination firewall, or return routing. Seeing a reply leave the LAN but not reach the client points to an asymmetric route or an address-translation problem.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
8. Test from outside when hairpin NAT is absent
An internal client that connects to the gateway’s public address is testing hairpin (loopback) NAT, not ordinary Internet-to-LAN forwarding. Without an explicit hairpin design, that test may fail even while external clients work. Use a genuinely external network, such as a separate Internet connection, for the first validation. Only troubleshoot hairpin behavior after the external path succeeds.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Make custom NAT rules survive UFW reloads
Ubuntu’s UFW workflow uses iptables-restore and rule files under /etc/ufw. The default files primarily configure filtering, but custom NAT entries can be added in /etc/ufw/before.rules, before the filter-table section. Put the DNAT logic in the rule-file workflow rather than relying on an interactive command that disappears when UFW reloads or the machine reboots.
After editing the file, run:
sudo ufw reload
Then verify the live rules with iptables -t nat -S and check counters during a new connection attempt. If the rule appears in the file but not in the live table, inspect syntax, table placement, and reload output. Keep the NAT definition and the UFW route permission conceptually separate: one rewrites the destination, the other permits the resulting forwarded flow.
Fix the return path, not just the inbound rule
A successful inbound DNAT packet is only half of a TCP exchange. The internal server must send its reply to the client. If the server’s default gateway is another router, the reply may bypass the forwarding machine. The client then sees an unsolicited or incomplete exchange and the connection fails, even though the request reached the service.
Recommended Free Tools
Prefer correcting the internal routing so replies to the client network return through the forwarding gateway. Where that cannot be guaranteed, source NAT or masquerading may be required as part of the gateway design. Apply it narrowly to the forwarded flow and internal interface rather than hiding all internal traffic by default. Verify the result with captures on both interfaces: the translated request should arrive at the server, and the server’s reply should return through the same gateway that handled the inbound connection.
Choose between a UFW route rule and custom DNAT
| Design | What it does | Where configuration lives | Forwarding control | Return-path concern | IPv4/IPv6 scope | Diagnostics |
|---|---|---|---|---|---|---|
| UFW route-rule design | Permits traffic already addressed and routed toward an internal destination; it is suitable when translation is handled elsewhere or is not needed. | UFW commands and its managed rule files. | Controlled by DEFAULT_FORWARD_POLICY plus explicit ufw route rules. |
The internal host still needs a route back to the client. | Use the rules and forwarding settings appropriate to the IP version being routed. | UFW status, route rules, forwarding counters, and packet captures. |
| UFW plus custom-DNAT design | Rewrites a public destination to an internal address and possibly a different port, then permits the translated flow. | DNAT in the NAT section of /etc/ufw/before.rules, with UFW route permission for the forwarded traffic. |
DNAT does not bypass the FORWARD filter; policy and route rules still apply. |
Correct internal routing or narrowly scoped source NAT may be necessary. | IPv4 and IPv6 forwarding and translation are separate concerns; do not infer one from the other. | iptables -t nat -S, filter counters, UFW logs, and captures on WAN and LAN. |
Use the first design when the destination is already correctly addressed and the gateway only needs to route it. Use the second when clients connect to a public address or port that must be rewritten to an internal service. In either case, forwarding, filtering, and return routing remain independent checks.
Common symptoms and precise fixes
- The firewall itself answers, but the internal service does not: the rule may be a local-input rule rather than a route rule, or DNAT is absent. Confirm the destination rewrite and add the scoped
ufw route allowpermission. - No packets appear on the LAN capture: check the WAN interface match, public port, protocol, route to the target subnet, kernel forwarding, and whether the DNAT rule loaded.
- Packets reach the server but it never responds: check that the service is listening on the translated address and that the server’s local firewall permits the connection.
- The server responds, but the client times out: inspect the server’s default gateway and the return route. Correct asymmetric routing or use narrowly scoped source NAT where appropriate.
- External clients work but an internal client fails: the internal test is exercising hairpin NAT, which may not be configured. Retest externally before changing the working Internet path.
- A rule works until reboot or reload: move custom NAT into the UFW rule-file workflow, commonly
/etc/ufw/before.rules, and reload UFW. - IPv4 works but IPv6 does not: inspect IPv6 forwarding tunables and rules separately. IPv4’s
net.ipv4.ip_forwardsetting does not enable IPv6 forwarding. - DNAT counters rise while FORWARD counters do not: the packet is being translated but blocked by forwarding policy or a filter rule. Inspect
DEFAULT_FORWARD_POLICY, route rules, and chain order.
A safe change-and-verify checklist
- Record the public interface, internal interface, public port, internal address, internal port, and protocol.
- Prove the service works directly on the internal network.
- Confirm the gateway route to the target subnet and the target host’s route back to clients.
- Enable the required IPv4 or IPv6 kernel forwarding setting and make it persistent through the documented UFW sysctl configuration.
- Set or review UFW’s forwarding policy in
/etc/default/ufw. - Add a specific
ufw route allow in on ... out on ...rule. - Add the DNAT rule in the NAT section of
/etc/ufw/before.ruleswhen destination translation is required. - Reload UFW and verify both NAT and filter rules in the live tables.
- Generate one test connection while watching counters and WAN/LAN captures.
- Only after the external path works, decide whether a separate hairpin NAT configuration is needed for internal clients using the public address.
What a working result looks like
The external SYN appears on the WAN capture, matches the DNAT rule, and appears on the LAN capture with the internal destination and port. The UFW route rule and forwarding policy allow it through. The internal service accepts it and sends a reply. That reply follows a route back through the gateway, or is translated by an intentional, narrowly scoped source-NAT rule. A failure at any one of those stages produces a different symptom, which is why checking the complete path is more reliable than repeatedly adding broad allow rules.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
