Effortless pfSense Port Forwarding: Fix Closed WAN Ports & Bypass CGNAT
Configure pfSense port forwarding and Destination NAT. Resolve closed ports, fix Source Port mistakes, set up VLAN rules and NAT reflection, and bypass ISP CGNAT.
Quick Answer: How to Port Forward in pfSense
In pfSense, port forwarding is configured under Firewall > NAT > Port Forward. Click Add, set Interface to WAN, Protocol to TCP or UDP, and Destination to "WAN address". Set Destination Port Range to your service port (e.g. 25565 for Minecraft, 42420 for Vintage Story, 32400 for Plex). In Redirect Target IP, enter your internal server IPv4 address, and set Filter Rule Association to "Add associated filter rule". Crucially, leave Source and Source Port set to "any". If your WAN IPv4 is in 100.64.0.0/10 or ports remain closed after applying, your ISP enforces CGNAT—requiring a VPN with native port forwarding like Proton VPN or PureVPN Dedicated IP to establish inbound reachability.
Mastering pfSense Port Forwarding: Inbound NAT & CGNAT Fixes
In pfSense, pfSense port forwarding is managed under Firewall > NAT > Port Forward using Destination NAT (DNAT). To open a port, configure Interface: WAN, Protocol: TCP/UDP, Destination: WAN address, Destination Port: [Target Port], Redirect Target IP: [Server LAN IP], and set Filter Rule Association: Add associated filter rule. Crucially, always leave Source and Source Port set to "any".
You chose pfSense because you value enterprise-grade security, granular stateful packet inspection, and absolute network sovereignty over consumer router shortcuts. But that rigorous architecture is precisely why port forwarding in pfSense can feel so punishing when an external connection test returns "Connection Refused".
Unlike consumer home routers (like Asus, Netgear, or TP-Link) that silently combine NAT translation, firewall exceptions, and loopback reflection into a single sloppy checkbox, pfSense maintains strict cryptographic separation between Destination NAT redirection, Firewall Filter Rules, and Interface routing boundaries. A single tiny discrepancy—such as typing your game port into the Source Port box, selecting "LAN address" instead of "WAN address", or missing NAT reflection—will cause pfSense's state table to quietly drop 100% of incoming packets without a trace.
Interactive pfSense Port Forwarding Rule Generator
Select a service preset (e.g. Minecraft, Vintage Story, Plex, SSH, or qBittorrent) or specify custom ports to preview the exact pfSense webConfigurator form fields.
| pfSense WebGUI Field | Exact Value to Enter | Technical Rationale |
|---|---|---|
| Disabled | [Unchecked] | Ensures rule is actively evaluated in the pf rule pipeline. |
| Interface | WAN | The interface that receives incoming SYN packets from the internet. |
| Address Family | IPv4 | Standard IPv4 NAT traversal. (IPv6 does not use NAT). |
| Protocol | TCP | Matches protocol requirement: TCP for web/Minecraft, UDP for Vintage Story. |
| Source / Source Port Range | any / any to any | Client machines connect from random ephemeral ports (1024-65535). |
| Destination | WAN address | Packets arrive addressed to your public WAN IP header, not LAN IP. |
| Destination Port Range | 25565 to 25565 | The public listening port forwarded into your network. |
| Redirect Target IP | 192.168.1.150 | Internal IP address of your game or homelab server host. |
| Redirect Target Port | 25565 | Port your internal daemon is actively listening on. |
| Filter Rule Association | Add associated filter rule | Auto-generates the corresponding pass rule in Firewall > Rules > WAN. |
[pfSense WebGUI Form Values: Firewall > NAT > Port Forward > Add] ---------------------------------------------------------------------- Disabled: [Unchecked] No RDR (Pass): [Unchecked] Interface: WAN Address Family: IPv4 Protocol: TCP Source: Type: "any" | Source Port Range: "any" to "any" Destination: WAN address Destination Port Range: From: 25565 | To: 25565 Redirect Target IP: 192.168.1.150 Redirect Target Port: 25565 Description: Port Forward for Minecraft Java Server NAT Reflection: Pure NAT (Hairpin Loopback) Filter Rule Association: Add associated filter rule (Auto-creates matching WAN rule)
Step-by-Step pfSense Port Forwarding Setup (WAN to LAN & VLAN)
Follow these sequential instructions in the pfSense webConfigurator to establish an active, verified Destination NAT rule.
Navigate to Firewall > NAT
Log into your pfSense dashboard (default: https://192.168.1.1). In the top navigation bar, click Firewall > NAT. Ensure you are on the default Port Forward tab, then click the Add button (use the up arrow to place the rule at the top of the evaluation list).
Select WAN Interface & Protocol
Leave Interface set to WAN and Address Family to IPv4. Select your transport protocol: choose TCP for Minecraft, Plex, or Web; UDP for Vintage Story; or TCP/UDP for game engines that utilize both.
Leave Source as "Any"
Critical step: Leave Source set to "any" and Source Port Range set to "any to any". Remote internet clients connect from random ephemeral source ports (1024-65535). Specifying your service port here causes pfSense to drop 100% of incoming packets.
Set Destination to "WAN Address"
In the Destination dropdown, choose WAN address. Inbound packets arriving from the internet hit your pfSense router with your public WAN IP as their destination. Setting Destination to "LAN address" or your server IP will cause pfSense to ignore the incoming traffic.
Specify Port Range & Target IP
In Destination Port Range, enter your port in both "From" and "To" fields (e.g. 25565). In Redirect Target IP, enter your internal server IPv4 address (e.g. 192.168.1.150). Set Redirect Target Port to match.
Auto-Generate Filter Rule & Apply
Scroll down to Filter Rule Association and select Add associated filter rule. Click Save, then click the blue Apply Changes button at the top. Test external reachability via NAT Checker.
Troubleshooting: Why pfSense Port Forwarding Is Not Working
If an external port check reports "Connection Refused" or "Filtered", run through this diagnostic checklist to isolate the failure in 2 minutes.
1. Check Your pfSense WAN IP Address (The Carrier-Grade NAT Trap)
Navigate to Status > Interfaces. Inspect the WAN IPv4 address reported by pfSense. If it falls into 100.64.0.0/10 (RFC 6598 CGNAT) or private RFC 1918 subnets (192.168.x.x, 10.x.x.x), your ISP does not assign you a public IPv4 address. Incoming unsolicited traffic is dropped at the provider's carrier router before it ever touches your pfSense box. Local router port forwarding will never work without an external VPN tunnel.
2. Verify Source and Source Port Range Are Set to "Any"
The #1 configuration blunder in pfSense is specifying a Source Port (e.g. entering 25565 in the Source field). When a remote player or client connects, their operating system assigns a randomized high ephemeral port (e.g. 54210) directed at your destination port. Setting Source Port to your service port drops 100% of incoming connections.
3. Destination Must Be Set to "WAN Address", Never LAN Address
Users migrating from consumer routers often mistakenly set Destination to "LAN address" or type in their internal server IP. In pfSense Destination NAT, the rule inspects the destination IP in the packet header as it enters the WAN interface—which is your public IP. Setting Destination to LAN results in zero matching packets.
4. Enable NAT Reflection for Local LAN Loopback Testing (Hairpin NAT)
Can external friends connect to your server, but you cannot connect using your public IP or DDNS hostname from inside your home network? By default, pfSense drops internal traffic attempting to loop back out through the WAN IP. Go to System > Advanced > Firewall & NAT, scroll to NAT Reflection mode for port forwards, set it to Pure NAT, and check Enable automatic outgoing NAT for Reflection.
5. Target Server Host Firewall & Socket Binding (0.0.0.0 vs 127.0.0.1)
Even when pfSense redirects packets flawlessly, Windows Defender Firewall or Linux UFW/iptables on the destination server frequently drops incoming connections from non-local subnets. Verify that your service daemon is bound to all interfaces (0.0.0.0) using netstat -an or ss -tulpn rather than localhost (127.0.0.1).
pfSense Port Forwarding on VLANs & Dedicated Game Hosting
Homelab administrators frequently segregate gaming servers and IoT appliances onto isolated VLAN subnets (e.g. VLAN 20 - DMZ) to shield the primary LAN from potential vulnerabilities.
Vintage Story requires master UDP listening port 42420. When running on an isolated VLAN in pfSense, verify that your Firewall > Rules > VLAN20 interface rules allow outbound return traffic to the internet gateway. Ensure the server's serverconfig.json has "Ip": null or "0.0.0.0" to permit external socket binding.
Minecraft Java Edition runs on TCP 25565. Bedrock Edition runs on UDP 19132. If using the GeyserMC plugin for cross-play, forward both ports to the same internal IP. In pfSense, create separate rules or a single port alias, and ensure your WAN filter rule passes both protocols.
If you wish to forward external SSH port 22 to an internal server, you must first change the pfSense WebGUI/SSH management port under System > Advanced > Admin Access (e.g. to port 2222). Otherwise, incoming connections to WAN port 22 will collide with pfSense's own administrative daemon.
When WAN Port Forwarding Is Impossible: Bypassing ISP CGNAT
What happens when you configure every pfSense NAT rule flawlessly, yet port checkers still report Connection Refused or Closed?
The Three Unfixable ISP Roadblocks:
- Carrier-Grade NAT (CGNAT): ISPs pool thousands of customers behind a shared public IP in the
100.64.0.0/10range. Unsolicited inbound packets are dropped at the carrier level. - ISP Port Blocking: Most residential providers permanently block incoming ports 80, 443, 22, 25565, or P2P torrent ports to force subscribers into costly commercial plans.
- Public Exposure Risks: Direct WAN port forwarding exposes your home residential IP to DDoS attacks, port scanning bots, and DMCA swarms (for Docker torrenting like qBittorrent).
The enterprise solution is creating an encrypted VPN gateway tunnel with native port forwarding directly inside pfSense. By terminating an inbound tunnel on pfSense, traffic bypasses ISP CGNAT entirely, terminating at a public VPN gateway that forwards incoming requests directly to your internal homelab services.
Proton VPN Plus
Native NAT-PMP & WireGuard on pfSense
Proton VPN is the gold standard for high-performance inbound port forwarding on pfSense. Using its high-speed WireGuard tunnel integration and NAT-PMP protocol, pfSense can request and maintain an open port lease dynamically, routing torrent swarms (qBittorrent in Docker) and game servers straight past ISP CGNAT.
- Native NAT-PMP Support: Compatible with
natpmpcon pfSense and Docker. - 10 Gbps WireGuard Speeds: High-bandwidth P2P servers with zero throttling.
- Swiss Privacy Jurisdiction: Strictly audited zero-logs policy; hides your residential IP.
- 30-Day Money-Back Guarantee: Test port forwarding risk-free.
Tested with pfSense 24.x WireGuard • 30-day money-back guarantee
PureVPN
Dedicated IP & Static Port Forwarding Addon
If you hate running dynamic NAT-PMP refresh scripts or managing ephemeral port numbers that change every time your tunnel reconnects, PureVPN is the cleanest homelab solution. It grants you a static Dedicated IP with a fixed port forwarding add-on, allowing you to configure your pfSense NAT rules once and forget them forever.
- Static Port Assignment: Choose your exact port; never changes on reconnect or reboot.
- No Complex Cron Scripts: Eliminate fragile dynamic port sync daemons on pfSense.
- Dedicated Clean Public IP: Perfect for Plex, self-hosted web servers, and game hosting.
- 31-Day Satisfaction Guarantee: Full refund if it doesn't solve your CGNAT.
Permanent static port forwarding • 31-day money-back guarantee
This page contains affiliate links. If you sign up through them, NAT Checker may earn a commission at no extra cost to you.
pfSense Inbound Routing Architecture: Standard WAN vs. VPN Gateway
| Feature / Scenario | Standard ISP WAN | Proton VPN (pfSense) | PureVPN (Dedicated IP) |
|---|---|---|---|
| Bypasses ISP CGNAT | No (Blocked by ISP) | Yes (100% Inbound) | Yes (100% Inbound) |
| Port Persistence | Static (If public IP) | Dynamic (NAT-PMP lease) | Permanent Static Port |
| IP Shielding & Privacy | None (Exposes Home IP) | Full Swiss Zero-Logs | Dedicated IP Masking |
| Configuration Effort | Low (If no CGNAT) | Medium (Requires NAT-PMP) | Very Low (Set Once) |
| Best For | Simple non-CGNAT WAN | Docker Torrents / qBittorrent | Plex, Games, Web Servers |
| Direct Solution | — | Get Proton VPN | Get PureVPN |
Related Firewall, NAT & VPN Guides
Deepen your homelab network setup with our related in-depth tutorials:
Frequently Asked Questions About pfSense Port Forwarding
How do I do port forwarding in pfSense?
To forward a port in pfSense: Go to Firewall > NAT > Port Forward and click Add. Select Interface: WAN, Protocol: TCP/UDP, Destination: WAN address, Destination Port Range: [Your Port], Redirect Target IP: [Internal Host IP], and Redirect Target Port: [Your Port]. Ensure Filter Rule Association is set to "Add associated filter rule", then click Save and Apply Changes.
Why is my pfSense port forwarding not working?
The five most common reasons pfSense port forwarding fails are: (1) Setting a specific Source Port instead of "any"; (2) Setting Destination to LAN IP instead of "WAN address"; (3) Missing NAT Reflection when testing from inside your home LAN; (4) The host machine local firewall (Windows Defender / UFW) dropping packets from external subnets; and (5) Your ISP puts you behind CGNAT (WAN IP in 100.64.0.0/10 or private ranges) or blocks inbound ports.
Should Destination be WAN address or LAN address in pfSense port forwarding?
Destination must ALWAYS be set to "WAN address". Inbound packets arriving from the internet hit your pfSense router with your public WAN IP as the destination header. Setting Destination to "LAN address" or your internal server IP will cause pfSense to ignore 100% of incoming WAN packets.
Why does my forwarded port work on mobile cellular data but fail inside my home network?
This happens when NAT Reflection (hairpinning) is disabled. When a device inside your LAN tries to connect to your public WAN IP or DDNS hostname, pfSense drops the packet by default. Go to System > Advanced > Firewall & NAT, scroll to Network Address Translation, and set NAT Reflection mode for port forwards to "Pure NAT" with "Enable automatic outgoing NAT for Reflection".
How do I port forward Vintage Story and Minecraft dedicated servers in pfSense?
For Vintage Story, forward UDP port 42420 with Destination: WAN address and Redirect Target: Server IP. For Minecraft Java Edition, forward TCP port 25565 (or UDP 19132 for Bedrock Edition). Always verify the server daemon is actively bound to 0.0.0.0 (all interfaces) rather than 127.0.0.1 (localhost).
How do I forward ports to a server located on an isolated VLAN in pfSense?
In Firewall > NAT > Port Forward, keep Interface set to WAN and enter the VLAN host IP in Redirect Target IP. In addition, inspect Firewall > Rules > [VLAN_NAME] to ensure your inter-VLAN isolation rules do not block the return traffic back out of the default gateway.
How does Proton VPN port forwarding work with pfSense and WireGuard?
Proton VPN supports NAT-PMP dynamic port forwarding over WireGuard or OpenVPN tunnels on pfSense. You assign the Proton tunnel as an OPT interface in pfSense, run a lightweight NAT-PMP client script (natpmpc) on pfSense or within Docker to obtain the ephemeral forwarded port, and create a Port Forward rule on the VPN interface to route traffic to your internal client (such as qBittorrent).
How does PureVPN dedicated static port forwarding simplify pfSense homelabs?
Unlike dynamic NAT-PMP providers where the forwarded port changes on every tunnel reconnect or gateway reboot, PureVPN offers a Dedicated IP with a static Port Forwarding add-on. You choose your dedicated external port once, hardcode it into your pfSense NAT rules and internal services, and eliminate the need for complex cron scripts or dynamic port sync daemons.