Port Forwarding in pfSense (NAT Rule Setup) #
To allow access to a specific port or forward a port to a private/internal machine, you need to create a NAT rule in pfSense. Follow the steps below:
Step 1: Open the NAT Page
Top menu → Firewall → NAT.
Step 2: Add a New Rule
Click the Add (+) icon to create a new port-forwarding rule.
Step 3: Basic Rule Settings
- Interface: WAN. Address Family: IPv4.
Step 4: Protocol & IP Settings
- Protocol: TCP / UDP / TCP-UDP, based on the internal service (TCP for web servers, UDP for DNS/VoIP).
- Source: Any (unless restricting to specific IPs).
- Destination: your public (WAN) IP, from the Environment Details Sheet.
- Redirect Target IP: the private IP of your internal ECS instance.
Step 5: Choose the Port Mapping Type
Many-to-One (PAT): a port range (e.g., 80–90) forwards to a single internal port (e.g., 80).
Step 6: One-to-One Port Mapping
Destination Port Range 80–80 → Redirect Target Port 80 → Redirect Target IP: [ECS private IP].
Step 7: Finalize and Save
- Set Destination Port Range From/To (e.g., both 80).
- Enter Redirect Target IP and Redirect Target Port.
- Add a Description for future reference, then click Save.
Step 8: Apply the Rule
Click Apply Changes at the top of the page to activate the rule.
Step 9: Access the Service
The internal service is now reachable via http://[Public IP]:[Port]. Confirm the internal service is running and listening on the configured port.