Port forwarding on a UniFi Dream Machine Special Edition is straightforward in the UniFi Network application, but it works only if the device's address, the rule and the internet connection all line up, and the last of these is the one most often wrong. The UDM SE is a rack gateway with a built-in PoE switch and no Wi-Fi radio, with the same processor as the UDM Pro, managed through UniFi Network. A forwarding rule sends traffic that arrives at the gateway's public address on a chosen port to a device on your network, for a game server, a camera, a remote desktop or a web service.
The checks in more detail
First give the target a fixed address. In UniFi Network, open the client list, select the device, and set a fixed IP address, or create a DHCP reservation, so that the address never changes. Then create the rule. Open Settings and find the Port Forwarding section, which is under Firewall and Security or Routing depending on the version, and add a rule: name it, choose the protocol, TCP, UDP or both, set the external port the internet will use, the forward IP address of the device and the forward port it listens on.
Make sure that the rule is enabled and that the interface is the WAN you use. If your gateway has two WANs, choose the right one. Check the other sides. The device's own firewall must allow the port, and the application must be running and listening. Test from outside your network with a phone on mobile data or an online port checker, since tests from inside often fail with some setups unless hairpin NAT is enabled. Check that the gateway's WAN address is a public one:
if it is a private address or begins with 100.64, your provider uses carrier-grade NAT, which makes forwarding impossible; ask the provider for a public address. If the UDM SE sits behind another router, you have a double NAT; use bridge mode on the first or forward on both. Review the firewall rules and any threat-management settings, since an intrusion prevention feature can block traffic. If you do not need a fixed external address, use dynamic DNS. Quote the model and the serial number to Ubiquiti if the port stays closed.
Differential
Likely causes of “Ubiquiti UniFi Dream Machine Special Edition port forwarding is not working”, and how to tell them apart
- 1
The target has no fixed address
What separates it The rule fails after a lease changes
How to confirm Set a fixed address or a DHCP reservation
- 2
A wrong port, protocol or WAN in the rule
What separates it The port shows closed
How to confirm Match the application and the WAN
- 3
The device firewall or application not listening
What separates it The gateway rule is right and the port stays closed
How to confirm Allow the port and run the application
- 4
Carrier-grade NAT or a double NAT
What separates it Nothing works from outside
How to confirm Ask for a public address or use bridge mode
- 5
A firewall or threat-management rule
What separates it Traffic is dropped
How to confirm Review the rules and the intrusion settings
Before you touch a setting
Record this first — changing settings destroys the evidence
- The application and its ports
- The device's address
- The gateway's WAN address
- Whether a second router is in front
Try in this order
0 of 6 completedFix the target's address
ReversibleReservation.
Add the rule
ReversibleIn Port Forwarding.
Match the ports and WAN
ReversibleProtocol too.
Allow the port
ReversibleOn the device.
Test from outside
ReversibleOn mobile data.
Check the WAN address
ReversibleFor carrier-grade NAT.
Model-specific
What is true of this model and not of its siblings
- A fixed address
- The rule points at one address.
- The rule
- External port, protocol, forward address and port.
- Testing
- Test from outside the network.
- NAT types
- Carrier-grade and double NAT block forwarding.
- Firewall
- Rules and IPS can drop traffic.
- Ubiquiti help
- Quote the model and serial number.
Stop boundary
When this stops being a self-service repair
- !Do not forward ports to an insecure device
- !Close rules you no longer use
- !Contact Ubiquiti if the port stays closed
Evidence ledger
Sources behind this answer
Exact questions
Common questions
How do I forward a port on a UDM SE?+
Fix the address, then add a rule in Port Forwarding.
Why is my port closed?+
The device, a double NAT or carrier-grade NAT.
Where is the setting?+
Under Firewall and Security or Routing, by version.
Can IPS block it?+
Yes.
Should I test from inside?+
No, from outside.