Port Forwarding Rules Configuration

Dashboard Location: Security and SD-WAN > Configure > Firewall > Forwarding rules

External Port Access Management

Port forwarding rules configuration in Meraki appliances enables the redirection of external traffic from specific public ports to internal hosts and services, providing controlled external access to internal resources without requiring dedicated public IP addresses. This functionality allows organizations to efficiently expose internal services such as web servers, databases, and applications to external clients while maintaining network security through source IP restrictions and protocol controls. Port forwarding is essential for cost-effective service deployment, supporting legacy applications that require specific port access, and enabling remote access to internal systems while conserving public IP address resources.

Diagram

Classes

firewall (meraki.domains.organizations.networks.appliance)

Name	Type	Constraint	Mandatory	Default Value
port_forwarding_rules	List	`[port_forwarding_rules]`	No

port_forwarding_rules (meraki.domains.organizations.networks.appliance.firewall)

Name	Type	Constraint	Mandatory	Default Value
name	String	min: `1`, max: `127`	No
lan_ip	IP		Yes
uplink	Choice	`both`, `internet1`, `internet2`, `internet3`	No
public_port	Any	Integer[min: `1`, max: `65535`] or String[matches: `(?:[1-9][0-9]3	[1-5][0-9]4	6[0-4][0-9]3
local_port	Any	Integer[min: `1`, max: `65535`] or String[matches: `(?:[1-9][0-9]3	[1-5][0-9]4	6[0-4][0-9]3
allowed_ips	List	Any[IP or String[matches: `[Aa]ny`]]	Yes
protocol	Choice	`tcp`, `udp`	Yes

Examples

Example-1: The example below demonstrates port forwarding rules configuration using tested YAML configuration from pipeline fixtures.

meraki:
  domains:
    - name: "!env domain"
      administrator:
        name: "!env org_admin"
      organizations:
        - name: "!env org"
          networks:
            - name: "!env network_name"
              product_types:
                - appliance
                - switch
                - wireless
                - camera
                - sensor
                - cellularGateway
              appliance:
                firewall:
                  port_forwarding_rules:
                    - name: "Port Forwarding Rule 1"
                      lan_ip: "192.168.128.10"
                      uplink: both
                      public_port: 8080
                      local_port: 80
                      allowed_ips:
                        - "192.168.1.1"
                      protocol: tcp
                    - name: "Port Forwarding Rule 2"
                      lan_ip: "192.168.128.20"
                      uplink: both
                      public_port: 8081
                      local_port: 80
                      allowed_ips:
                        - "192.168.1.1"
                        - "any"
                      protocol: tcp
                    - name: "SSH Remote Access"
                      lan_ip: "!env server_management_ip"
                      uplink: "both"
                      public_port: "2222"
                      local_port: "22"
                      allowed_ips:
                        - "!env admin_networks"
                      protocol: tcp

Configuration Parameters

Parameter	Type	Required	Description
`firewall_port_forwarding`	Object	Yes	Port forwarding configuration container
`rules`	Array	Yes	List of port forwarding rule definitions
`rules[n].name`	String	Yes	Descriptive name for the forwarding rule
`rules[n].lan_ip`	String	Yes	Internal destination IP address
`rules[n].uplink`	String	Yes	Uplink interface: “internet1”, “internet2”, “both”, “cellular”
`rules[n].public_port`	String	Yes	External port number for incoming traffic
`rules[n].local_port`	String	Yes	Internal destination port number
`rules[n].allowed_ips`	Array	Yes	List of allowed source IPs: “any” or specific IPs/networks
`rules[n].protocol`	String	Yes	Protocol: “tcp”, “udp”

Port Forwarding Strategies

Strategy	Public Port	Local Port	Use Case	Security Considerations
Direct Mapping	Same as local	Same as public	Standard services	Medium security
Port Translation	Different from local	Different from public	Security by obscurity	Higher security
High Port Mapping	>1024	Standard port	Reduce automated attacks	Good security
Multiple Mappings	Various	Same service	Load distribution	Complex management

Common Service Mappings

Service	Standard Port	Alternative Port	Protocol	Security Level
HTTP	80	8080, 8000	TCP	Medium
HTTPS	443	8443, 9443	TCP	High
SSH	22	2222, 2200	TCP	High
RDP	3389	33389, 3390	TCP	High
SMTP	25	2525, 587	TCP	Medium
IMAP	143, 993	1143, 9930	TCP	Medium
POP3	110, 995	1100, 9950	TCP	Medium
DNS	53	5353	UDP	Low
VPN	1194, 500	11194, 4500	UDP	Medium
Database	3306, 5432	33060, 54320	TCP	Very High

Uplink Configuration Options

Uplink Setting	Behavior	Use Cases	Availability Considerations
internet1	Primary uplink only	Cost optimization	Single point of failure
internet2	Secondary uplink only	Load distribution	Backup connectivity
both	Active on both uplinks	High availability	Requires both uplinks
cellular	Cellular uplink only	Mobile/remote sites	Data cost implications

Access Control Levels

Access Level	Allowed IPs	Security Impact	Management Overhead	Scalability
Public	”any”	Low security	Low	High
Network-Based	Specific networks	High security	Medium	Medium
Host-Based	Individual IPs	Maximum security	High	Low
Hybrid	Mixed approach	Balanced security	Medium-High	Medium

Service Planning Matrix

Service Type	Public Access	Recommended Port	Access Control	Monitoring Level
Web Services	Yes	Standard/Alternative	Source filtering	Medium
Database	No	Non-standard	Strict restrictions	High
Remote Access	Limited	Non-standard	Admin networks only	High
Mail Services	Yes	Standard	Protocol-specific	Medium
VPN Services	Yes	Standard/Alternative	Certificate-based	Medium
Management	No	Non-standard	Admin access only	High