Complete OPNsense Port Forwarding Guide: Fix 26.1 Inbound NAT
Step-by-step OPNsense port forwarding and Destination NAT tutorial. Fix closed ports, common source port mistakes, CGNAT, and Proton VPN tunnels.
Quick Answer: OPNsense Port Forwarding (Destination NAT)
In OPNsense 26.1+, port forwarding is configured under Firewall > NAT > Port Forward. Create a rule with Interface: WAN, TCP/IP Version: IPv4, Protocol: TCP/UDP, Destination: WAN address, Destination Port Range: [Target Port], Redirect Target IP: [Internal Host IP], and Redirect Target Port: [Target Port]. Always leave Source and Source Port set to "any". Set Filter Rule Association to "Rule NAT [service]" to automatically generate matching firewall rules. If behind ISP CGNAT or hosting behind a commercial VPN gateway, use Proton VPN NAT-PMP or PureVPN Dedicated IP to route inbound traffic.
Complete OPNsense Port Forwarding Guide: Fix 26.1 Inbound NAT
In OPNsense 26.1 and newer, opnsense port forwarding is managed under Firewall > NAT > Port Forward (technically Destination NAT). To forward traffic, set Interface to WAN, Destination to WAN address, Destination Port to your service port, and Redirect Target IP to your internal server. You must leave Source and Source Port set to "any" and select Filter Rule Association: Rule NAT.
You configured OPNsense because you demand the security, transparency, and granular packet filtering of enterprise FreeBSD pf. But enterprise firewalls are unforgiving: unlike consumer routers that silently open firewall pinholes in the background, a single inadvertent entry in OPNsense—such as entering a source port or picking "LAN address" as the destination—will cause 100% of external packets to be dropped with zero feedback.
Whether you are hosting Plex Media Server, a Minecraft world, Sunshine game streaming, or hosting homelab services behind a commercial VPN gateway, this guide provides the exact field parameters, fixes the 5 deadliest port-forwarding traps, and shows how to configure Proton VPN and PureVPN tunnels in OPNsense.
Interactive OPNsense Destination NAT Rule Visualizer
Select a service preset or enter custom ports to preview the exact OPNsense form fields.
Exact OPNsense Web GUI Fields (Firewall > NAT > Port Forward)pf Inbound Rule
OPNsense Port Forwarding Not Working? The 5 Deadliest Mistakes
If you followed an online tutorial, updated to OPNsense 26.1, and discovered your external port is closed or your opnsense port forwarding not working, check these five specific configuration errors before touching anything else:
1. The Fatal "Source Port" Trap (Causes 80% of Failures)
In OPNsense, the Port Forward form contains two port fields: Source Port Range and Destination Port Range.
When a remote client (like a player joining your Minecraft server or a smartphone connecting to Plex) initiates a TCP/UDP connection, their operating system assigns a randomized ephemeral outbound port (between 1024 and 65535). The only port that is guaranteed to be 25565 or 32400 is the Destination Port.
Result: OPNsense drops 100% of incoming packets because remote clients connect from ephemeral ports like 54128.
The Fix: Leave Source and Source Port set strictly to
any.2. Destination Address: "LAN Address" vs "WAN Address"
As reported in r/opnsense community threads (e.g. users migrating from Netgear Orbi or Asus routers), new administrators often set Destination to LAN Address or the internal IP of their server (192.168.1.100).
When packets arrive at your modem/ONT from the internet, their destination IP is your public WAN IP. Therefore, the Destination field must match WAN address (or your Virtual IP/CARP alias). Setting it to LAN address means the rule never triggers because packets hitting the WAN interface do not have a LAN destination header.
3. Filter Rule Association: The Invisible Firewall Drop
In FreeBSD pf architecture, NAT is separate from packet filtering. Translating an address via NAT does not automatically permit the packet through the firewall filter!
- If Filter rule association is set to None, OPNsense rewrites the destination IP in memory, but your default WAN block rule drops the packet at the firewall boundary.
- The Fix: Always select Rule NAT [service] (which creates an automatically managed linked pass rule under Firewall > Rules > WAN) or select Pass.
4. Missing NAT Reflection (Hairpin NAT): Works on 5G, Broken at Home
Have you ever tested your forwarded port by asking a friend to join, had it work flawlessly, but found that your own laptop on home Wi-Fi cannot connect using your public IP or DDNS hostname?
This is caused by missing Hairpin NAT (NAT Reflection). When an internal LAN host sends packets addressed to the router's external WAN IP, the router must reflect the packet back into the internal network:
- Global Toggle: Go to Firewall > Settings > Advanced.
- Check Reflection for port forwards and Automatic outgoing NAT for Reflection.
- Alternatively, set NAT reflection: Enable on the individual port forward rule.
5. Upstream Carrier-Grade NAT (CGNAT)
No firewall setting in OPNsense will open ports if your ISP does not assign you a public IPv4 address. If your OPNsense WAN interface reports an IP address in the 100.64.0.0/10 range (RFC 6598), your ISP is using CGNAT. Check your connection using our CGNAT diagnostic guide. To host services under CGNAT, see our VPN tunnel solution below.
Where Did Port Forwarding Go in OPNsense 26.1?
Following updates in OPNsense 26.1, multiple users posted in r/opnsense inquiring: "How to port forward on new Opnsense? Is port forwarding missing?"
In OPNsense 26.1, the navigation menu remains organized under Firewall > NAT > Port Forward. However, the internal documentation and rule displays emphasize the formal networking terminology: Destination NAT (DNAT).
Translates incoming traffic hitting your public IP on a specific port and reroutes it to a private internal host on your LAN/VLAN. Located at Firewall > NAT > Port Forward.
Translates outgoing traffic from your LAN devices so they can share your router's single public WAN IP on the internet. Located at Firewall > NAT > Outbound.
Secure Homelab Hosting via VPN Gateway: Proton VPN & PureVPN
Directly forwarding ports on your residential ISP WAN exposes your home public IP address to automated port scanners, Shodan indexing, and DDoS attacks. Furthermore, if you are stuck behind ISP CGNAT or want to seed torrents or host game servers anonymously, routing inbound traffic through a commercial VPN gateway configured inside OPNsense is the gold standard.
Resolving the Reddit Thread: "Unable to get ProtonVPN port-forward to work with NAT-PMP on OPNsense"
A common challenge discussed in r/opnsense is integrating Proton VPN's dynamic port forwarding into OPNsense. Unlike consumer apps where port forwarding is a 1-click toggle, OPNsense requires assigning the OpenVPN/WireGuard tunnel as an explicit Interface (e.g. OPT1_PROTON). A lightweight NAT-PMP client script requests an inbound port lease from the Proton endpoint, and an OPNsense Destination NAT rule on OPT1_PROTON redirects that port to your internal server.
Proton VPN Plus
WireGuard Tunneling & NAT-PMP Port Forwarding
Proton VPN Plus is the premier privacy VPN supporting active inbound port forwarding. Its NAT-PMP capability integrates cleanly with OPNsense WireGuard/OpenVPN interfaces to host game servers, qBittorrent, and remote media without exposing your home ISP WAN IP.
- NAT-PMP Port Forwarding: Full support for dynamic inbound leases.
- WireGuard & OpenVPN Profiles: Easy OPNsense interface configuration.
- Swiss Privacy Shield: Audited no-logs policy and DDoS mitigation.
- Risk-Free Guarantee: Full 30-day money-back guarantee.
Compatible with OPNsense 26.1 • 30-day money-back guarantee
PureVPN + Dedicated IP Add-On
Fixed Port Forwarding Gateway Without Port Drift
If you host Plex, Nextcloud, or game servers where your public port cannot afford to rotate on lease renewal, PureVPN provides a static Dedicated IP with custom port forwarding. Configure it once in OPNsense and never worry about changing ports.
- Static Inbound Ports: Zero port drift; your external port stays fixed.
- Bypass ISP CGNAT: Host servers on Starlink or 5G home internet.
- Multiple Port Mapping: Forward multiple custom ports simultaneously.
- Risk-Free Guarantee: 31-day money-back guarantee.
Ideal for static server hosting • 31-day money-back guarantee
This page contains affiliate links. If you sign up through them, NAT Checker may earn a commission at no extra cost to you.