Recommended Free Tools
Forwarding traffic from port 8080 (or any other port) to port 80 depends on where the web service runs. For a service on the same Linux host, use a local NAT redirect: nftables redirect to :80 or firewalld’s --add-forward-port without a destination address. For a service on another host, use destination NAT (DNAT) with the destination host’s address, allow packet forwarding, and ensure the reply can return through the forwarding machine.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The examples below use TCP port 8080 as the public or incoming port and TCP port 80 as the destination. Replace those values, the interface name, zone, and destination address to match your network.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesDecide whether this is a local redirect or routed DNAT
Port forwarding is a destination-NAT operation. The packet arrives with one destination port, the firewall changes that destination, and the connection continues according to the resulting packet path. The correct rule depends on whether the translated service is local or remote.
Same host: local redirect
If the application listening on port 80 runs on the same Linux machine that receives the connection on port 8080, use a redirect. In nftables, redirect to :80 is a special form of DNAT that always translates the destination address to the local host. It is intended for changing the destination port of incoming traffic, including traffic arriving on different interfaces.
#1 Best Overall
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
A local redirect does not send packets to another machine. The local kernel delivers the translated connection to the process bound to port 80.
Another host: DNAT with a destination address
If the service is on another machine, use DNAT with both a destination address and a destination port, such as dnat to 192.0.2.14:80. The forwarding machine must be allowed to route the packet, and the reply must return through a path that preserves the connection. NAT alone cannot overcome a forwarding policy that blocks the packet or a return route that bypasses the translator.
| Question | Same-host redirect | Remote-host DNAT |
|---|---|---|
| Where is the service? | On the Linux host receiving the traffic | On another IPv4 host |
| nftables action | redirect to :80 |
dnat to DESTINATION_IP:80 |
| Destination address required? | No; the local host is implied | Yes |
| Packet forwarding between interfaces required? | Usually no routed hop; local delivery still depends on host policy | Yes, along with a working return path |
| firewalld form | --add-forward-port=port=8080:proto=tcp:toport=80 |
Add :toaddr=DESTINATION_IP |
| IPv4/IPv6 scope | nftables can be written for the address family you need; the firewalld option shown is IPv4 | The firewalld option shown is IPv4; IPv6 uses rich language |
Check the host before changing NAT rules
Do these checks first. They separate an application problem from a translation problem and prevent a correct NAT rule from pointing at a port where nothing is listening.
- Confirm the application is listening on the target port:
ss -ltnp | grep ':80'. - Confirm that the incoming traffic is TCP. The examples use
tcp; a UDP client needs a UDP rule and a UDP service. - Identify the interface on which the connection arrives and, when using firewalld, the zone assigned to that interface.
- Determine whether the service binds to loopback only or to an external address. A process listening only on loopback may not accept traffic delivered to a different local address, while a remote DNAT target must be reachable on the destination network.
- Check which component owns the active firewall and NAT rules. Docker, UFW, firewalld, distribution services, and manually loaded nftables rules can overwrite or conflict with one another. Use one authoritative manager for the NAT table wherever possible.
Port 80 must have a listener before forwarding can succeed. Opening port 80 in a firewall is a separate operation: it permits traffic to a service already listening there, but it does not translate traffic arriving on port 8080.
Configure a same-host redirect with nftables
The following ruleset creates an IPv4 NAT table and a prerouting chain, then redirects TCP connections arriving on port 8080 to local port 80:
Rank #2
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
table ip nat {
chain prerouting {
type nat hook prerouting priority -100;
tcp dport 8080 redirect to :80
}
}Apply and adapt the rule
- Make sure the nftables service is available and that you are using the system’s active ruleset rather than a second, unmanaged firewall configuration.
- Add the table and chain shown above using your distribution’s nftables configuration method. The chain must be a NAT prerouting chain with priority
-100; the redirect rule belongs inside it. - Replace
8080with the incoming port if your client uses another port. Keeptcpfor a TCP service. - If the host has several interfaces or addresses, constrain the rule to the intended ingress interface or address. This prevents an unrelated interface from receiving the same translation.
- Verify the resulting configuration with
sudo nft list ruleset. - Connect to the host on port 8080 from the actual client network. The local process listening on port 80 should receive the connection.
The redirect changes the destination port while keeping the destination address local. It is therefore the simplest choice when a service has been configured to listen on 80 but clients must connect to another exposed port.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Compatibility note
nftables redirect support is recorded as available beginning with Linux kernel 3.19. A modern distribution normally satisfies that requirement, but a deliberately old kernel should be checked before deployment.
Make the nftables configuration survive a restart
Rules entered interactively are part of the currently loaded ruleset. Persist them using the nftables configuration and service mechanism supplied by your distribution, then reload that service during a maintenance window. After a reboot or firewall-service restart, run sudo nft list ruleset again and confirm that the NAT table, prerouting chain, and redirect rule are still present.
Send traffic to another host with nftables DNAT
For a service on a different IPv4 machine, specify both the destination address and port. This example accepts TCP port 8080 on interface ens3 and translates it to port 80 on 192.0.2.14:
table ip nat {
chain prerouting {
type nat hook prerouting priority -100;
iifname "ens3" tcp dport 8080 dnat to 192.0.2.14:80
}
}What the remote rule does
- The packet enters through
ens3with TCP destination port 8080. - The prerouting DNAT changes the destination to
192.0.2.14, port 80. - The Linux host routes the translated packet toward the destination network.
- Connection tracking keeps the translation associated with the flow so replies can be translated back to the client.
That sequence only works when the forwarding path is permitted. Check the host’s packet-forwarding setting and the forwarding policy between the incoming and outgoing interfaces. The destination host also needs a route back to the client, either through the forwarding machine or through a design that preserves a symmetric return path. If the reply takes a different route, the client may see a timeout even though the initial packet reached the server.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- NIGHTHAWK WIFI 6 ROUTER FOR YOUR WHOLE HOME: Delivers fast, reliable WiFi across every room of your apartment or small home for streaming, gaming, video calls, and smart home devices, all running at the same time without slowing each other down.
- WORKS WITH YOUR EXISTING INTERNET SERVICE: Pairs with your existing modem or gateway via ethernet. Compatible with most cable, fiber, DSL, and satellite providers. Some gateways and modem router combos may require bridge mode. No coax needed.
- SET UP AND MANAGE YOUR NETWORK WITH THE NIGHTHAWK APP: Download the free Nighthawk app on iOS or Android for guided setup. Manage WiFi, run speed tests, pause devices, and set up guest networks from anywhere. Active internet required.
- READY FOR THE DEVICES YOU ALREADY OWN: Your phones, laptops, and TVs work right out of the box. WiFi 6 delivers speeds up to 1.8 Gbps across 2.4 GHz and 5 GHz bands. Backward compatible with WiFi 5 and earlier.
- COVERAGE IN EVERY ROOM: Covers up to 1,500 sq. ft. for up to 20 connected devices. Walls, floors, and interference can reduce range. Larger or multi-story homes may benefit from a NETGEAR Orbi mesh WiFi system.
Limit the rule to the intended interface
The iifname "ens3" condition is important on a multi-interface host. Replace ens3 with the actual ingress interface. Omitting an interface condition can expose the translation on interfaces that were not intended to accept the service.
Inspect the active rule
Use sudo nft list ruleset to verify the table, chain type, hook, priority, interface condition, protocol, incoming port, and destination address. A typo in any one of those fields can leave the rule loaded but ineffective.
Use firewalld for a forward port
firewalld provides a higher-level command for IPv4 forward ports. It accepts TCP, UDP, SCTP, and DCCP; the examples below use TCP.
Forward to port 80 on the same host
sudo firewall-cmd --zone=public --add-forward-port=port=8080:proto=tcp:toport=80This creates a runtime forward-port rule in the public zone. Replace public with the zone assigned to the interface receiving the connection. No destination address is supplied, so the translation targets the local host.
Forward to port 80 on another IPv4 host
sudo firewall-cmd --zone=public --add-forward-port=port=8080:proto=tcp:toport=80:toaddr=192.0.2.14The toaddr value changes this from a local port translation to a routed IPv4 forward. firewalld’s documented behavior implicitly enables IP forwarding when toaddr is specified, but the forwarding policy and return route still have to permit the connection.
Rank #4
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐏𝐫𝐨𝐨𝐟 𝐘𝐨𝐮𝐫 𝐇𝐨𝐦𝐞 𝐖𝐢𝐭𝐡 𝐖𝐢-𝐅𝐢 𝟕: Powered by Wi-Fi 7 technology, enjoy faster speeds with Multi-Link Operation, increased reliability with Multi-RUs, and more data capacity with 4K-QAM, delivering enhanced performance for all your devices.
- 𝐁𝐄𝟑𝟔𝟎𝟎 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐑𝐨𝐮𝐭𝐞𝐫: Delivers up to 2882 Mbps (5 GHz), and 688 Mbps (2.4 GHz) speeds for 4K/8K streaming, AR/VR gaming & more. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance, and obstacles like walls.
- 𝐔𝐧𝐥𝐞𝐚𝐬𝐡 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠 𝐒𝐩𝐞𝐞𝐝𝐬 𝐰𝐢𝐭𝐡 𝐃𝐮𝐚𝐥 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭𝐬 𝐚𝐧𝐝 𝟑×𝟏𝐆𝐛𝐩𝐬 𝐋𝐀𝐍 𝐏𝐨𝐫𝐭𝐬: Maximize Gigabitplus internet with one 2.5G WAN/LAN port, one 2.5 Gbps LAN port, plus three additional 1 Gbps LAN ports. Break the 1G barrier for seamless, high-speed connectivity from the internet to multiple LAN devices for enhanced performance.
- 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝟐.𝟎 𝐆𝐇𝐳 𝐐𝐮𝐚𝐝-𝐂𝐨𝐫𝐞 𝐏𝐫𝐨𝐜𝐞𝐬𝐬𝐨𝐫: Experience power and precision with a state-of-the-art processor that effortlessly manages high throughput. Eliminate lag and enjoy fast connections with minimal latency, even during heavy data transmissions.
- 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐟𝐨𝐫 𝐄𝐯𝐞𝐫𝐲 𝐂𝐨𝐫𝐧𝐞𝐫 - Covers up to 2,000 sq. ft. for up to 60 devices at a time. 4 internal antennas and beamforming technology focus Wi-Fi signals toward hard-to-reach areas. Seamlessly connect phones, TVs, and gaming consoles.
Persist a firewalld rule
Without --permanent, a forward-port change is runtime state and disappears after a reboot or firewalld restart. Add the permanent rule and reload:
sudo firewall-cmd --permanent --zone=public --add-forward-port=port=8080:proto=tcp:toport=80
sudo firewall-cmd --reloadThe reload applies the permanent configuration. Confirm the active result with the firewalld forward-port listing for the zone and test from a real client.
IPv6 and firewalld
The --add-forward-port form described here is an IPv4 option. For IPv6 forward ports, use firewalld’s rich language rather than assuming that the IPv4 command creates an IPv6 translation. Keep the address family explicit when troubleshooting; an IPv4 rule cannot match an IPv6 packet.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not confuse a forward port with an opened port
These commands only permit traffic to a service already listening on the target port; they do not create the service. Conversely, --add-port=80/tcp or --add-service=http merely allows traffic addressed directly to port 80. Neither command redirects port 8080 to port 80.
Verify the complete path
Verification should progress from the application outward. Testing only from the forwarding host can hide interface, zone, or hairpin behavior that affects real clients.
Best Value
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Run
ss -ltnp | grep ':80'on the service host. Confirm the expected process and listening address. - Inspect nftables with
sudo nft list ruleset, or inspect the firewalld forward-port list for the relevant zone. - From a client on the actual source network, connect to the forwarding host’s address on port 8080. Use the client’s normal hostname or address rather than assuming local loopback behavior matches production traffic.
- For a remote target, verify that the forwarding host can reach the destination address on port 80 and that the destination host permits the connection.
- Check the reply path. A stateful firewall normally allows return traffic for an established connection, but the route still must bring replies back through the expected translator.
- Repeat the test from a second network when possible. A connection that works from inside the server’s network may fail externally because of zone assignment, upstream filtering, or hairpin handling.
Troubleshoot by symptom
No process is listening on port 80
If ss shows no listener, fix the application first. NAT can change where a packet is sent, but it cannot make an absent service answer. Also check whether the process listens only on loopback while the translated destination uses another local address.
The rule is not active
If the nftables table or rule is missing from sudo nft list ruleset, it was not loaded into the active ruleset or another manager replaced it. With firewalld, verify that you used the correct zone and distinguish runtime from permanent configuration. A permanent rule is not active until firewalld is reloaded.
The port or protocol does not match
A TCP rule does not match UDP traffic. Confirm the client protocol and destination port, then compare them with the rule’s tcp dport or firewalld proto=tcp setting. Check that the client is reaching the interface and zone where the rule is installed.
Local redirect works, remote DNAT times out
This usually indicates a forwarding or return-path issue rather than a translation syntax issue. Confirm that packet forwarding is enabled, the forwarding policy allows traffic between the relevant interfaces or zones, and the destination host has a route back to the client. NAT does not bypass those requirements.
The rule works on one interface but not another
Review interface conditions such as iifname "ens3" and firewalld zone assignments. A packet entering through a different interface can bypass a rule restricted to the first interface or be evaluated under a zone with different policy.
It works locally but not from the real client
Loopback and hairpin traffic can traverse different hooks and policies from traffic arriving through a physical or virtual interface. Test from the actual client network and inspect the rule for the interface and address family used by that client.
Another firewall manager keeps changing the result
Running multiple managers against the same NAT table creates non-obvious failures. Identify whether firewalld, UFW, Docker, a distribution service, or manually loaded nftables configuration owns the rules. Consolidate NAT management under one authoritative component and then reload that component before retesting.
Choose an operating approach
| Situation | Recommended approach | Reason |
|---|---|---|
| One host, TCP 8080 to local TCP 80 | nftables redirect or firewalld forward-port without toaddr |
Only the destination port needs to change; the local host is the destination. |
Forwarder to IPv4 server 192.0.2.14 |
nftables DNAT or firewalld forward-port with toaddr |
The destination address and port both need translation. |
| IPv6 traffic managed by firewalld | firewalld rich language | The documented forward-port option shown is IPv4-specific. |
| Distribution already standardizes on firewalld | Use firewalld commands and persistent configuration | One manager keeps runtime, permanent, and zone state consistent. |
| Distribution manages a native nftables ruleset | Use the existing nftables configuration and service | Direct rules remain visible in one authoritative ruleset. |
Whichever method you choose, document the incoming port, protocol, interface or zone, target address, target port, and persistence method. That record makes it clear whether a later failure is an application, routing, policy, or NAT problem.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
