UniFi Port Forwarding

If you're hosting services inside your network and want remote people to access it the best choice is a VPN. If you can't or don't want the VPN then you can use port forwarding. Let's see what that looks like with UniFi these days!
UniFi Affilate Links (I earn a commission on these links):
UniFi Express: store.ui.com/u...
UXG Lite: store.ui.com/u...
UXG Pro: store.ui.com/u...
CloudKey G2Plus: store.ui.com/u...
UDR: store.ui.com/u...
UDM Pro: store.ui.com/u...
UDM SE: store.ui.com/u...
UniFi Dream Wall: store.ui.com/u...
Hire us! williehowe.com
Want to join us in learning how to deploy network services like this? Put your name on the training list now: williehowe.com...
Affiliate Links (I earn a small percentage of the sale if you use these links):
My AmazonLink: www.amazon.com...
Ubiquiti EdgeRouter X: amzn.to/3rwxooN
Ubiquiti EdgeRouter 4: amzn.to/3rkjy99
GWN7624 Access Point: amzn.to/4551PjF
GWN7801P Switch: amzn.to/3PPESg5
Palo Alto PA-400: amzn.to/3Rxcz7w
Ubiquiti EdgeRouter X: amzn.to/3rwxooN
Ubiquiti EdgeRouter 4: amzn.to/3rkjy99
Grandstream GWN7062: amzn.to/3ZtPBjw
Teltonika RUT300: amzn.to/3PvKomu
Ubiquiti USG: amzn.to/3PNhxvm
TP-Link ER605: amzn.to/3Zq583G
Ubiquiti UniFi Dream Router: amzn.to/3PNB8f7
Protectli Vault 4 Port: amzn.to/3t91JtY
Protectli Vault 2 Port: amzn.to/451gdcW
Mikrotik hEX Lite: amzn.to/4580k49
Mikrotik hEX S: amzn.to/451CTtt
EnGenius ESG510: amzn.to/3RtD3GQ
Synology RT6600ax: amzn.to/3EMMmtR
Synology WRX560: amzn.to/46kw0V5
Rackmount Intel Appliance: amzn.to/3F7EGTr
Cisco C1101-4P: amzn.to/48riili
Juniper SRX100B: amzn.to/3PMuWDU
AXIS T8508 Switch: amzn.to/3RzXBh5
AXIS T8508 Rack Kit: amzn.to/3ZA5hSf
Netool: netool.io use code WHT to save at least 10%!
Digital Ocean Affiliate Link: m.do.co/c/39aa...
Patreon Link: / williehowe
Contact us for network consulting and best practices deployment today! We support all Grandstream, Synology, DrayTek, Obihai, Poly, Ubiquiti, MikroTik, Extreme, Palo Alto, and more!
Come back for the next video!
Twitter - @WillieHowe
TikTok - @whowe82
SUBSCRIBE! THUMBS-UP! Comment and Share!

[@ekowlloyd]

Apart from the quality content, there's something else I like about your vids - you cut the chase, in less than 10 seconds you always get the ball rolling. Thanks for that

[@WillieHowe]

It wasn't always that way!

[@The_Tech_Ninja]

Thanks from Austria for your great content all the time. I did the same for a PLEX Media Server

[@PaulAllsopp-uj1tg]

Thanks Wille. Still learning my DMP.

[@rx2gamingofficial]

I love how perfect this interface is. The UISP NAT config is so annoying I'm trying to return my UISP-R for a UXG-Lite

[@WillieHowe]

Interesting

[@kschasteen]

Can you create a web server and a honeypot and see how long it takes for someone from the outside to infiltrate the network?

[@rickroller5742]

quick and easy thank you

[@ArthursHD]

I would like to install Netbird and only allow it to connect from certain countries before it even gets to Netbird itself. On Mikrotik it is easy, just import an address list. UFW is similar, just run a command pointing to a list. Seems like I need to look at how to do it from CLI on Unifi. As for RDP EvlWatcher will reduce failed login attempts. Besides the firewall source list. I would not use MFA alone since in (65%) of cases, RDP is used to establish initial access to the target endpoint.

[@user-rq1bg2uv2b]

Thank you for this... Helped me a lot...

[@alessandrodebonasartor3143]

Hi Willie. Thanks for the content. I’m wondering if you can use more than one op address to filter the source or still need to create several rules to allow different IPs addresses.

[@WillieHowe]

New rule for each source address or create a firewall rule with a group of addresses.

[@johntankard]

​@@WillieHowehi, I tried this on a udm pro and could not get it to work. I was trying to create a port forward to a proxy server and then limit the incoming port forward to cloudflares IP ranges, on pfsense this was so easy... it seems on a udm pro not so, is there any chance you could do a quick video showing how to tied port forward with firewall rules as when I try all my ports are still exposed.... Cheers John.

[@Kuth70]

Kinda similar but maybe different situation. I have a Wifi Doorbell that REQUIRES being on the same subnet as the hardwired NVR. On unifi all my SSIDs are on their own subnets (as they should be). How can I make the doorbell send its traffice to an IP on its own subnet that forwards to the IP of the NVR on the LAN subnet? Should this be as simple as creating a port forward?

[@b3owu1f]

Just got my Express. Set up port forwarding to my Plex service. Sadly it still says remote access not available. Not sure why. Restarted the plex server as well, just to be sure.

[@merashid1]

Willie, thanks for the video. I have set up a single server behind UDM SE Pro using port forwarding and it works. But we have many servers with unique public IP and with different web apps running on them. Is there a way to route traffic to each of these servers when the request comes in? Users will use a URL that is mapped to a public IP .

[@mikescott4008]

I assume you can’t create a group for ports. So if I know it’s UDP/123, TCP/443 etc. I can’t create a group. In Sophos for example you can granularly define items.

[@JasonsLabVideos]

I might grab one of these units to play with !

[@homenetworkguy]

Hold up-- you want to get a UniFi product? 😜

[@JasonsLabVideos]

To try yeah ! Then will give it away !@@homenetworkguy

[@hex6ng]

I have the same Port forwarding config on a UDM Pro and it always stop working whenever there is an ISP internet outage, then I have to restart UDM Pro to get it working again. Very annoying.

[@alexgunner2244]

Hi Willie. Port forwarding is new to me. How do I setup Plex Port forwarding? Thank you for your videos on networking.

[@b3owu1f]

Set up port 32400 (public port) and set the ip to the internal IP of the server/service Plex is running on. The port should be the same, 32400. I am however having an issue with my new Express but it could just be some delayed issue I am seeing.

[@thoicool]

Thank you!

[@Moonraker11]

I like your Security Settings of blocking China & Russia...do you notice a lot of false positive blocking events with security set this high?

[@WillieHowe]

Nope.

[@jean-philipryll6381]

Many Thanks also from Germany! Do you know how to "automaticly block dubious traffic" on single ports?

[@WillieHowe]

Can you explain that a bit more?

[@jean-philipryll6381]

@@WillieHowe in my thoughts, the UDM should be able to detect if my E-Mail-Server is compromised. (If it sends tons of E-Mails, or if my server gets part of a Botnet)

[@ThebigGametDad]

can you port forward over wifi? im trying to host a server and i have unblocked my ports are not working.

[@WillieHowe]

You should be able to do this.

[@AndersMorch52]

Hi Willie, Thanks a lot for your contribution, to understand the Unifi world . - The port that is forwarded is only accessible from outside the network, why can’t I access it from within, as I could with my old router (ASUS).

[@WillieHowe]

Hairpin Nat is enabled by default.

[@AndersMorch52]

Hallo again: Is there a way to enable Hairpin Nat for my UXG lite? - Unfortunate I don’t see any checkbox or option to do that in Unifi Console 8.0.7

[@WillieHowe]

@@AndersMorch52 it's enabled by default

[@AndersMorch52]

Thank you, and sorry for my confusion, I mean: how do I disable it - what I want is the possibility to see my server’s external interface (WEB sites) inside my LAN from my LAN - as it is now, I only can see it from outside my network.

[@WillieHowe]

@@AndersMorch52 there's a lot to unpack here. Please email me.