Ubiquiti's port forwarding article gives the current path: in Network 9.4 go to Settings, Policy Engine, Port Forwarding, and in 9.3 use Settings, Policy Table, Create New Policy, Port Forwarding. Name the rule, choose one WAN or all, set the incoming address and port and whether it comes from anywhere or specific addresses, set the forward address and port to the target device, choose TCP, UDP or both, and optionally enable syslog. It lists the causes when a rule seems not to work.
The checks in more detail
The gateway may not have a public address, as with double NAT or carrier NAT: check whether the WAN address is in 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 or 100.64.0.0/10. A WAN port can be forwarded to only one device, so TCP 443 can go to just one LAN host, though several WAN ports can go to the same LAN port. UPnP may already be using the port; Ubiquiti recommends keeping UPnP disabled unless needed, and to disable it under Internet settings to test.
Traffic may be blocked upstream at the modem or a third-party firewall. The LAN host may be blocking the port with its own firewall or may have the wrong default gateway. Test from outside the network and remove rules you no longer use. Before you forward anything, decide whether you need to. Many services, such as remote viewing of cameras or file access, have a secure cloud or VPN route that does not expose a port.
If you do forward, choose a non-standard external port, limit the source addresses where you can, keep the target device updated and review the list of rules every few months. Give each rule a clear name so that an old rule is obvious when you look at the list. If a rule works from outside but not from inside the house, that is hairpin NAT, and the fix is to use the device's internal address or a local DNS record for indoor use.
Differential
Likely causes of “Ubiquiti UniFi gateways port forwarding is not working”, and how to tell them apart
- 1
Double or carrier NAT
What separates it The rule never sees traffic because a double NAT or carrier NAT sits in front of the gateway
How to confirm Bridge the modem or the provider's unit, so that the gateway has a public address
- 2
The WAN port already forwarded
What separates it There is a conflict because the WAN port is already forwarded to another device
How to confirm Forward each WAN port once only, since a WAN port can go to one device
- 3
UPnP using the port
What separates it The rule is ignored because UPnP already uses the port
How to confirm Disable UPnP as a test, and see whether the manual rule then works
- 4
A LAN host firewall
What separates it The connection is refused because the firewall on the LAN host blocks the port
How to confirm Allow the port in the host's own firewall, as well as in the gateway's rule
- 5
A wrong route on the host
What separates it There is no reply because the host has a wrong route back to the gateway
How to confirm Fix the host's default gateway, so that replies go back through the UniFi gateway
Before you touch a setting
Record this first — changing settings destroys the evidence
- The settings of the rule that you created
- Whether UPnP is switched on for the gateway
- The state of the firewall on the host
Try in this order
0 of 7 completedOpen Port Forwarding
ReversibleOpen Port Forwarding, which is in the Policy Engine or the Policy Table, depending on the version.
Create the rule
ReversibleCreate the rule by giving it a name, choosing the WAN interface and entering the ports.
Set the target
ReversibleSet the target, by entering the address and the port of the device on the LAN.
Choose the protocol
ReversibleChoose the protocol for the rule, which can be TCP, UDP or both, depending on the service.
Check for conflicts
ReversibleCheck for conflicts, such as UPnP using the same port, or a second rule for the same port.
Test from outside
ReversibleTest from outside your home network, using cellular data on a phone rather than your wifi.
Remove unused rules
ReversibleRemove unused rules regularly, so that ports are not left open when they are not needed.
Model-specific
What is true of this model and not of its siblings
- Menus
- The Policy Engine path applies to Network 9.4; earlier versions differ.
- Multi-WAN
- You can choose one WAN or all WANs.
Stop boundary
When this stops being a self-service repair
- !If the port stays closed with a public WAN address and no upstream firewall, contact Ubiquiti support
- !If the provider blocks the port, ask the provider
- !If the host does not reply, check its routing
Evidence ledger
Sources behind this answer
Rules and why they fail.
UPnP and its risks.
Teleport invitations and IPv6.
Remote access choices.
The company and its products.
Exact questions
Common questions
Can one WAN port go to two devices?+
No, one WAN port can be forwarded to only one device on the LAN.
What does UPnP do?+
UPnP opens ports automatically, though Ubiquiti recommends keeping it switched off.
Can the host block it?+
Yes, the host can block the traffic through its own firewall, so allow the port there too.
Can I log rules?+
Yes, you can log rules, using syslog, to see what traffic they match.
Is a VPN better?+
Ubiquiti suggests WireGuard or Teleport for remote access, instead of opening ports.