Main Menu
  • COMPANY
    • Boundless Cybersecurity
    • Press Releases
    • News
    • Awards
    • Leadership
    • Press Kit
    • Careers
  • PROMOTIONS
    • SonicWall Promotions
    • Customer Loyalty Program
  • MANAGED SERVICES
    • Managed Security Services
    • Security as a Service
    • Professional Services
SonicWall
  • Products
    • Network Security
      • Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
      • Security ServicesComprehensive security for your network security solution
      • Network Security ManagerModern Security Management for today’s security landscape
    • Advanced Threat Protection
      • Capture ATPMulti-engine advanced threat detection
      • Capture Security applianceAdvanced Threat Protection for modern threat landscape
    • Access Security
      • Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
      • Secure Mobile AccessRemote, best-in-class, secure access
      • Wireless Access PointsEasy to manage, fast and secure Wi-FI
      • SwitchesHigh-speed network switching for business connectivity
    • Email Security
      • Email SecurityProtect against today’s advanced email threats
    • Cloud Security
      • Cloud App SecurityVisibility and security for Cloud Apps
      • Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
    • Endpoint Security
      • Capture ClientStop advanced threats and rollback the damage caused by malware
      • Content Filtering ClientControl access to unwanted and unsecure web content
    • Product Widgets
      • Product Menu Right Image
      • Capture Cloud Platform
        Capture Cloud Platform

        A security ecosystem to harness the power of the cloud

    • Button Widgets
      • Products A-Z
        all products A–Z FREE TRIALS
  • Solutions
    • Industries
      • Distributed Enterprises
      • Retail & Hospitality
      • K-12 Education
      • Higher Education
      • State & Local
      • Federal
      • Healthcare
      • Financial Services
      • Carriers
    • Use Cases
      • Secure SD-Branch
      • Zero Trust Security
      • Secure SD-WAN
      • Office 365 Security
      • SaaS Security
      • Secure WiFi
    • Solutions Widgets
      • Solutions Content Widgets
        Federal

        Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions

      • Solutions Image Widgets
  • Partners
    • SonicWall Partners
      • Partners Overview
      • Find a Partner
      • Authorized Distributors
      • Technology Partners
    • Partner Resources
      • Become a Partner
      • SonicWall University
      • Training & Certification
    • Partner Widgets
      • Custom HTML : Partners Content WIdgets
        Partner Portal

        Access to deal registration, MDF, sales and marketing tools, training and more

      • Partners Image Widgets
  • Support
    • Support
      • Support Portal
      • Knowledge Base
      • Technical Documentation
      • Community
      • Video Tutorials
      • Product Life Cycle Tables
      • Partner Enabled Services
      • Contact Support
    • Resources
      • Resource Center
      • Free Trials
      • Blog
      • SonicWall University
      • MySonicWall
    • Capture Labs
      • Capture Labs
      • Security Center
      • Security News
      • PSIRT
      • Application Catalog
    • Support Widget
      • Custom HTML : Support Content WIdgets
        Support Portal

        Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials

      • Support Image Widgets
  • COMPANY
    • Boundless Cybersecurity
    • Press Releases
    • News
    • Awards
    • Leadership
    • Press Kit
    • Careers
  • PROMOTIONS
    • SonicWall Promotions
    • Customer Loyalty Program
  • MANAGED SERVICES
    • Managed Security Services
    • Security as a Service
    • Professional Services
  • Contact Sales
  • English English English en
  • BLOG
  • CONTACT SALES
  • FREE TRIALS
  • English English English en
SonicWall
  • Products
    • Network Security
      • Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
      • Security ServicesComprehensive security for your network security solution
      • Network Security ManagerModern Security Management for today’s security landscape
    • Advanced Threat Protection
      • Capture ATPMulti-engine advanced threat detection
      • Capture Security applianceAdvanced Threat Protection for modern threat landscape
    • Access Security
      • Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
      • Secure Mobile AccessRemote, best-in-class, secure access
      • Wireless Access PointsEasy to manage, fast and secure Wi-FI
      • SwitchesHigh-speed network switching for business connectivity
    • Email Security
      • Email SecurityProtect against today’s advanced email threats
    • Cloud Security
      • Cloud App SecurityVisibility and security for Cloud Apps
      • Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
    • Endpoint Security
      • Capture ClientStop advanced threats and rollback the damage caused by malware
      • Content Filtering ClientControl access to unwanted and unsecure web content
    • Product Widgets
      • Product Menu Right Image
      • Capture Cloud Platform
        Capture Cloud Platform

        A security ecosystem to harness the power of the cloud

    • Button Widgets
      • Products A-Z
        all products A–Z FREE TRIALS
  • Solutions
    • Industries
      • Distributed Enterprises
      • Retail & Hospitality
      • K-12 Education
      • Higher Education
      • State & Local
      • Federal
      • Healthcare
      • Financial Services
      • Carriers
    • Use Cases
      • Secure SD-Branch
      • Zero Trust Security
      • Secure SD-WAN
      • Office 365 Security
      • SaaS Security
      • Secure WiFi
    • Solutions Widgets
      • Solutions Content Widgets
        Federal

        Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions

      • Solutions Image Widgets
  • Partners
    • SonicWall Partners
      • Partners Overview
      • Find a Partner
      • Authorized Distributors
      • Technology Partners
    • Partner Resources
      • Become a Partner
      • SonicWall University
      • Training & Certification
    • Partner Widgets
      • Custom HTML : Partners Content WIdgets
        Partner Portal

        Access to deal registration, MDF, sales and marketing tools, training and more

      • Partners Image Widgets
  • Support
    • Support
      • Support Portal
      • Knowledge Base
      • Technical Documentation
      • Community
      • Video Tutorials
      • Product Life Cycle Tables
      • Partner Enabled Services
      • Contact Support
    • Resources
      • Resource Center
      • Free Trials
      • Blog
      • SonicWall University
      • MySonicWall
    • Capture Labs
      • Capture Labs
      • Security Center
      • Security News
      • PSIRT
      • Application Catalog
    • Support Widget
      • Custom HTML : Support Content WIdgets
        Support Portal

        Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials

      • Support Image Widgets
  • COMPANY
    • Boundless Cybersecurity
    • Press Releases
    • News
    • Awards
    • Leadership
    • Press Kit
    • Careers
  • PROMOTIONS
    • SonicWall Promotions
    • Customer Loyalty Program
  • MANAGED SERVICES
    • Managed Security Services
    • Security as a Service
    • Professional Services
  • Contact Sales
  • Menu

How can I enable port forwarding and allow access to a server through the SonicWall?

03/02/2022 22,375 People found this article helpful 318,037 Views

    Download
    Print
    Translations
    • Portuguese
    Share
    • LinkedIn
    • Twitter
    • Facebook
    • Email
    • Copy URL The link has been copied to clipboard

    Description

    This article describes how to access an Internet device or server behind the SonicWall firewall. This process is also known as opening ports, PATing, NAT or Port Forwarding.

    For this process the device can be any of the following:

    • Web Server
    • FTP Server
    • Email Server
    • Terminal Server
    • DVR (Digital Video Recorder)
    • PBX
    • SIP Server
    • IP Camera
    • Printer
    • Application Server
    • Any custom Server Roles
    • Game Consoles

    Don't want to read? Watch instead!



    Cause

    By default the SonicWall disallows all Inbound Traffic that isn't part of a communication that began from an internal device, such as something on the LAN Zone. This is to protect internal devices from malicious access, however it is often necessary to open up certain parts of a network, such as Servers, to the outside world.

    To accomplish this the SonicWall needs a Firewall Access Rule to allow the traffic from the public Internet to the internal network as well as a Network Address Translation (NAT) Policy to direct the traffic to the correct device.

    Resolution

    Resolution for SonicOS 7.X

    This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.

     

    Manually opening Ports / enabling Port forwarding to allow traffic from the Internet to a Server behind the SonicWall using SonicOS involves the following steps:

    1. Creating the necessary Address Objects
    2. Creating the appropriate NAT Policies which can include Inbound, Outbound, and Loopback
    3. Creating the necessary Firewall Access Rules

      These steps will also allow you to enable Port Address Translation with or without altering the IP Addresses involved.

     TIP: The Public Server Wizard is a straightforward and simple way to provide public access to an internal Server through the SonicWall. The Public Server Wizard will simplify the above three steps by prompting your for information and creating the necessary Settings automatically. Click Quick Configuration in the top navigation menu.You can learn more about the Public Server Wizard by reading How to open ports using the SonicWall Public Server Wizard.

     CAUTION: The SonicWall security appliance is managed by HTTP (Port 80) and HTTPS (Port 443), with HTTPS Management being enabled by default. If you are using one or more of the WAN IP Addresses for HTTP/HTTPS Port Forwarding to a Server then you must change the Management Port to an unused Port, or change the Port when navigating to your Server via NAT or another method.

     

    Image

    The following walk-through details allowing HTTPS Traffic from the Internet to a Server on the LAN. Once the configuration is complete, Internet Users can access the Server via the Public IP Address of the SonicWall's WAN. Although the examples below show the LAN Zone and HTTPS (Port 443) they can apply to any Zone and any Port that is required. Similarly, the WAN IP Address can be replaced with any Public IP that is routed to the SonicWall, such as a Public Range provided by an ISP.

    Creating the necessary Address Objects

    1. Login to the SonicWall GUI.
    2. Click Object in the top navigation menu.
    3. Click Match Objects | Addresses.
    4. Click Add and create two Address Objects for the Server's Public IP and the Server's Private IP.
    5. Click Save to add the Address Object to the SonicWall's Address Object Table.
      Image

      Image

     Creating the necessary Service Object

    1. Click Object in the top navigation menu
    2. Click Match Objects | Services.
    3. Click the Add button and create the necessary Service Objects for the Ports required.
    4. Ensure that you know the correct Protocol for the Service Object (TCP, UDP, etc.). If you're unsure of which Protocol is in use, perform a Packet Capture.
    5. Click Save to add the Service Object to the SonicWall's Service Object Table.
      Image

    Creating the appropriate NAT Policies which can include Inbound, Outbound, and Loopback

    A NAT Policy will allow SonicOS to translate incoming Packets destined for a Public IP Address to a Private IP Address, and/or a specific Port to another specific Port. Every Packet contains information about the Source and Destination IP Addresses and Ports and with a NAT Policy SonicOS can examine Packets and rewrite those Addresses and Ports for incoming and outgoing traffic.

    1. Click Policy in the top navigation menu.
    2. Click Rules and Policies| NAT Rules.
    3. Click the Add button at the bottom of the page and a pop-up window will appear.
    4. For the Inbound NAT policy, select the fields as below on the Original and translated tabs. Leave all fields on the Advanced/Actions tab as default. Click on Add to add the NAT Policy to the SonicWall NAT Policy Table.
      Image
      Image

    5. For the Outbound NAT policy, select the fields as below on the Original and translated tabs. Leave all fields on the Advanced/Actions tab as default. Click on Add to add the NAT Policy to the SonicWall NAT Policy Table.
      Image
      Image

       NOTE: When creating an inbound NAT Policy you may select the "Create a reflexive policy" checkbox in the Advanced/Actions tab. This will create an inverse Policy automatically, in the example above adding a reflexive policy for the inbound NAT Policy will also create the outbound NAT Policy. This option is not available when editing an existing NAT Policy, only when creating a new Policy.
      Image


      Loopback NAT Policy
      A Loopback NAT Policy is required when Users on the Local LAN/WLAN need to access an internal Server via its Public IP/Public DNS Name. This Policy will "Loopback" the Users request for access as coming from the Public IP of the WAN and then translate down to the Private IP of the Server. Without a Loopback NAT Policy internal Users will be forced to use the Private IP of the Server to access it which will typically create problems with DNS.
      If you wish to access this server from other internal zones using the Public IP address Http://1.1.1.1 consider creating a Loopback NAT Policy:
      On the Original tab:

      • Original Source: Firewalled Subnets
      • Original Destination: Example Name Public
      • Original Service: Example Service Object
      • Inbound Interface: Any
      • Outbound Interface: Any
        Image


      On the translated tab:


      • Translated Source: Example Name Public
      • Translated Destination: Example Name Private
      • Translated Service: Original
        Image


     Creating the necessary Firewall Access Rules

    1. Click Policy in the top navigation menu.
    2. Click Rules and Policies | Access Rules.
    3. Select the View Type as Matrix and select your WAN to Appropriate Zone Access Rule. (This will be the Zone the Private IP of the Server resides on.)
    4. Click the Add button at the bottom of the screen and in the pop-up window create the required Access Rule by configuring the fields as shown below in the Source/Destination tab. Leave all other tabs on default.
    5. Click Add when finished.
      Image


    Resolution for SonicOS 6.5

    This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.

    Manually opening Ports / enabling Port forwarding to allow traffic from the Internet to a Server behind the SonicWall using SonicOS involves the following steps:

    1. Creating the necessary Address Objects
    2. Creating the appropriate NAT Policies which can include Inbound, Outbound, and Loopback
    3. Creating the necessary Firewall Access Rules

      These steps will also allow you to enable Port Address Translation with or without altering the IP Addresses involved.

    TIP: The Public Server Wizard is a straightforward and simple way to provide public access to an internal Server through the SonicWall. The Public Server Wizard will simplify the above three steps by prompting your for information and creating the necessary Settings automatically. Click Quick Configuration in the top navigation menu.You can learn more about the Public Server Wizard by reading How to open ports using the SonicWall Public Server Wizard.

    CAUTION: The SonicWall security appliance is managed by HTTP (Port 80) and HTTPS (Port 443), with HTTPS Management being enabled by default. If you are using one or more of the WAN IP Addresses for HTTP/HTTPS Port Forwarding to a Server then you must change the Management Port to an unused Port, or change the Port when navigating to your Server via NAT or another method.
    Image

    The following walk-through details allowing HTTPS Traffic from the Internet to a Server on the LAN. Once the configuration is complete, Internet Users can access the Server via the Public IP Address of the SonicWall's WAN. Although the examples below show the LAN Zone and HTTPS (Port 443) they can apply to any Zone and any Port that is required. Similarly, the WAN IP Address can be replaced with any Public IP that is routed to the SonicWall, such as a Public Range provided by an ISP.

    TIP: If your user interface looks different to the screenshot in this article, you may need to upgrade your firmware to the latest firmware version for your appliance. To learn more about upgrading firmware, please see Procedure to Upgrade the SonicWall UTM Appliance Firmware Image with Current Preferences.

    Creating the necessary Address Objects

    1. Log into the SonicWall GUI.
    2. Click Manage in the top navigation menu.
    3. Click Objects | Address Objects.
    4. Click the Add a new Address object button and create two Address Objects for the Server's Public IP and the Server's Private IP.
    5. Click OK to add the Address Object to the SonicWall's Address Object Table.
      Image

     Creating the necessary Service Object

    1. Click Manage in the top navigation menu
    2. Click Objects | Service Objects.
    3. Click the Add a new Service object button and create the necessary Service Objects for the Ports required.
    4. Ensure that you know the correct Protocol for the Service Object (TCP, UDP, etc.). If you're unsure of which Protocol is in use, perform a Packet Capture.
    5. Click OK to add the Service Object to the SonicWall's Service Object Table.
      Image

    Creating the appropriate NAT Policies which can include Inbound, Outbound, and Loopback

    A NAT Policy will allow SonicOS to translate incoming Packets destined for a Public IP Address to a Private IP Address, and/or a specific Port to another specific Port. Every Packet contains information about the Source and Destination IP Addresses and Ports and with a NAT Policy SonicOS can examine Packets and rewrite those Addresses and Ports for incoming and outgoing traffic.

    1. Click Manage in the top navigation menu.
    2. Click Rules | NAT Policies.
    3. Click the Add a new NAT Policy button and a pop-up window will appear.
    4. Click Add to add the NAT Policy to the SonicWall NAT Policy Table.

      NOTE: When creating a NAT Policy you may select the "Create a reflexive policy" checkbox. This will create an inverse Policy automatically, in the example below adding a reflexive policy for the NAT Policy on the left will also create the NAT Policy on the right. This option is not available when configuring an existing NAT Policy, only when creating a new Policy.

      Image
      Loopback NAT Policy
      A Loopback NAT Policy is required when Users on the Local LAN/WLAN need to access an internal Server via its Public IP/Public DNS Name. This Policy will "Loopback" the Users request for access as coming from the Public IP of the WAN and then translate down to the Private IP of the Server. Without a Loopback NAT Policy internal Users will be forced to use the Private IP of the Server to access it which will typically create problems with DNS.
      If you wish to access this server from other internal zones using the Public IP address Http://1.1.1.1 consider creating a Loopback NAT Policy:

    • Original Source: Firewalled Subnets
    • Translated Source: X1 IP
    • Original Destination: X1 IP
    • Translated Destination: Example Name Private
    • Original Service: HTTPS
    • Translated Service: Original
    • Inbound Interface: Any
    • Outbound Interface: Any
    • Comment: Loopback policy
    • Enable NAT Policy: Checked
    • Create a reflexive policy: Unchecked
      Image

     Creating the necessary Firewall Access Rules

    1. Click Manage in the top navigation menu.
    2. Click Rules | Access Rules.
    3. Select the View Type as Matrix and select your WAN to Appropriate Zone Access Rule. (This will be the Zone the Private IP of the Server resides on.)
    4. Click the Add a new entry/Add... button and in the pop-up window create the required Access Rule by configuring the fields as shown below.
    5. Click Add when finished..
      Image

    Related Articles

    • App Control fails by schema error when editing VPN category
    • How to remove 2FA for admin using CLI
    • 2FA authentication error using TOTP "Please try again later"

    Categories

    • Firewalls > SonicWall NSA Series > Networking
    • Firewalls > TZ Series > Networking
    • Firewalls > NSa Series > Networking
    • Firewalls > NSv Series > Networking

    Not Finding Your Answers?

    ASK THE COMMUNITY

    Was This Article Helpful?

    YESNO

    Article Helpful Form

    Article Not Helpful Form

    Company
    • Careers
    • News
    • Leadership
    • Awards
    • Press Kit
    • Contact Us
    Popular resources
    • Communities
    • Blog
    • SonicWall Capture Labs

    Stay In Touch

    • By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement. You can unsubscribe at any time from the Preference Center.
    • This field is for validation purposes and should be left unchanged.
    • Facebook
    • Twitter
    • Linkedin
    • Youtube
    • Instagram

    © 2022 SonicWall. All Rights Reserved.

    • Legal
    • Privacy
    • English
      Scroll to top
      Trace:8aab0ed913a2dfc0ab0713be2a845ae2-92