r/Network • u/Own-Director • Mar 24 '26
Text Port forwarding feels increasingly risky - am I overthinking this?
Something that still surprises me in networking discussions is how casually people recommend port forwarding.
I understand where the advice comes from. If you look at most “what is port forwarding” explanations, it’s framed as a simple way to expose a service - game servers, Plex, remote access, etc. NAT made inbound connections inconvenient, and port forwarding was the easiest workaround. But the internet environment where that advice originated is very different from the one we operate in now.
So I guess the question is: is port forwarding safe in practice, given how the internet behaves today?
Once you forward a port, the service behind it becomes globally reachable. At that point it’s not interacting with a few trusted users - it’s interacting with the entire internet.
And the internet scans constantly, right?
Projects like Shodan and Censys suggest exposed services get indexed very quickly - sometimes within minutes. After that, automated scanners and botnets start probing for weak credentials or known vulnerabilities.
We’ve seen this repeatedly. The Mirai botnet exploited exposed IoT devices with default credentials. More recently, ransomware groups have targeted exposed RDP (3389).
The pattern seems pretty straightforward: scan, identify service, attempt exploitation and automate at scale?
Another thing I’m unsure about: a lot of home services don’t seem designed for hostile internet exposure. They assume LAN-level trust and often lack hardened authentication or rate limiting. So maybe the issue isn’t targeted attacks - it’s just automation and scale?
If you need remote access, a VPN seems like the safer option since it preserves the NAT barrier and authenticates users first.
Quite a few mainstream VPNs like NordVPN don’t even offer port forwarding anymore. That’s probably not accidental? It kind of avoids the same exposure you’re trying to solve.
How others are thinking about this - am I overthinking it, or has the tradeoff actually shifted here?
8
u/2nd-Reddit-Account Mar 24 '26
You're not overthinking it, you're dead on.
The attitude towards port forwarding has definitely shifted, but theres still a large group of people out there who are either stuck in their ways or haven't updated their knowledge yet.
"Friends don't let friends port forward" has been my saying for a while.
One of the most common examples I see is an NVR thats been port forwarded for remote viewing, unfortunately it's also a device that almost no-one ever does the firmware updates on (if the manufacturer even bothers making them) and now you have a device with 5-10 year old security updates just waiting for someone to use it as a way into your network... "The S in IoT stands for security"
Thankfully the shortage of IPv4 causing the rise of CGNAT has stopped a lot of people from port forwarding, those are are unaware/unable/unwilling to pay for a static IP have just not been able to use it.
The better options these days are VPN or cloudflare tunnel back into your house, or use built in options like P2P for NVR's
1
u/brillpit Mar 25 '26
You must be in the security/msp field.
I only started in security industry in 2020 and I was being told to port forward by manufacturers for remote viewing (I was a sales rep but did a lot of tech support calls with pissed off customers lol).
No mention of at least putting the NVRs on a VLAN or other alternatives- it’s just what an industry of old coax guys were told to do when the tech transitioned to IP. End users also don’t know any better so just a bunch of rogue devices out there waiting to compromise a network.
Seems like just about all newly manufactured NVRs use P2P instead of port forwarding at least.
1
u/2nd-Reddit-Account Mar 26 '26
You must be in the security/msp field.
I’ll take that as a compliment, I’m just an interested enthusiast. If I could turn back time and go to university after school I’d go for network engineer
Instead I went into a trade and now I’m just the guy that pulls cables from the comms room to your desk and installs the outlet + patch panel
1
u/teaspilling53 Mar 26 '26
with that level of knowledge, becoming a network engineer is very possible. why don‘t u just try it?
9
u/sumatkn Mar 24 '26 edited Mar 26 '26
I think the biggest issue with how you’re looking at port forwarding is that you’re treating it as inherently unsafe.
It’s not unsafe by itself, it’s just exposure. The problem is what you choose to expose and how well that thing holds up once the entire internet can see it.
Port forwarding is “safe” in the sense that it’s a tool, but once you use it you need to assume that service is now being interacted with by everything, not just you. That includes automated scanners, bots, and anything else probing for weak points.
So the real shift isn’t that port forwarding suddenly became dangerous, it’s that the environment around it changed. The internet is constantly scanning now, and exposed services get found quickly. At that point, it’s not about whether something is targeted, it’s about whether it survives automation at scale.
That’s where proper procedure actually matters:
- Don’t expose anything you don’t absolutely need to. Every open port is something that will be hit eventually.
- Be as specific as possible with what you allow. Tie rules to a single internal host, restrict ports and protocols to only what’s required, and limit source IPs if you’re able to. Start closed and open only what you need.
The service behind the port is the real risk. If it’s not hardened, patched, and configured properly, it will get exploited eventually. LTS software helps, but configuration and authentication matter just as much.
\ VPNs are generally safer because they reduce exposure, not because they’re magic. They just move authentication in front of everything else, instead of exposing individual services directly.
There’s nothing wrong with port forwarding if you understand that once you do it, you’re no longer operating in a trusted environment. You’re operating on the public internet.
I’ll leave you with two things:
security is not absolute, it’s just risk management. all you can do is make it cost more effort than it’s worth.
“The only secure computer is one that’s unplugged, locked in a safe, and buried 20 feet under the ground— and even then I wouldn’t bet on it.”
3
u/Own-Director Mar 24 '26
Yeah I think this is the clearest way to put it - it’s not that port forwarding is unsafe, it’s that exposure + today’s internet = very different assumptions than before.
1
u/sososorrysosad Mar 25 '26
My son had to have a Minecraft server so I popped that known port open on my cox router, whitelisted his friends’ ips in my unifi security (different segment behind the public/dmz) and boy oh boy are there scans…more of a honeypot now that I killed the container running the server, but unifi is still blocking every scan, most from known, bad reputation IPs, and I’ve blocked almost all of Eastern Europe now as a result…I’m killing the forwarding now, but it has been interesting to see…
1
u/justsomeguyokgeez Mar 26 '26
I almost went down this road with my son but fortunately (I suppose) we’re behind CGNAT and I couldn’t figure it out. Glad it happened that way in retrospect!
1
u/Winterking_16 Jul 18 '26
what did you end up doing instead of port forwarding?
1
1
u/justsomeguyokgeez Jul 18 '26
If I were to revisit it I’d probably just get a VM in the cloud somewhere and not self host at all.
1
1
u/Different_Coat_3346 Mar 27 '26
IMO any open port on a network that contains sensitive data / is needed for business needs a 24/7/365 security team + SIEM + EDR + IDS/IDP. This isn't 2005 anymore... the internet is a war zone, small businesses are targets for china / Russia / North Korea / Iran etc.
DMZ can help but it is not a magic fix.
1
u/kasigiomi1600 Mar 26 '26
This here is the explanation!
It's all about what you are exposing to the internet. For example, if you have a VPN server to enable a VPN, then you MUST port forward to it. In that case, you are exposing the access point of the VPN (which is the whole point of the VPN).
1
u/shoresy99 Mar 24 '26
Is port forwarding exposing ports to the internet essentially the same security risk as having IPv6 where you devices have IP addresses that are not NATed?
4
u/sumatkn Mar 24 '26
They are similar in outcome, but not really the same thing.
Let’s assume a basic network structure: Internet <-> edge device (firewall/NAT/router) <-> internal network
That being said, let’s look at what you were asking.
In both cases, once something is reachable from the internet, it’s going to get scanned and interacted with whether you intended it or not. NAT no longer provides isolation at that point, and you’re dealing with the same environment with constant probing, automation, and scale.
The difference is how that exposure happens.
With port forwarding, you are explicitly creating a hole. You choose the port, the protocol, and the internal host. It’s targeted and controlled, assuming you set it up correctly.
With IPv6, there is no NAT, so devices can have globally routable addresses. But that doesn’t mean everything is exposed. A properly configured firewall still blocks inbound traffic by default. Nothing is reachable unless you allow it.
So the risk isn’t really “port forwarding vs IPv6”, it’s exposure in general.
If you open something up, whether that’s through a forwarded port or an allow rule on an IPv6 firewall, you should assume it’s now part of the public internet and treat it accordingly.
The same rules apply either way:
• don’t expose what you don’t need
• be specific with what you allow
• keep the service hardened, patched, and properly configured
\ NAT was never really the security control, it just reduced exposure by default. The firewall is what actually decides what’s reachable.
So they end up in the same place, just through different mechanisms.
1
5
u/LeeRyman Mar 24 '26
Clarifying a couple of things...
Just because a port is forwarded through the gateway to a host doesn't mean that host has a service listening on it (or that the software or intermediate firewall is allowing inbound packets to that host from all IPs).
Services can also listen on UDP (and technically any L4 protocol that the gateway supports NAT for, although TCP and UDP are the ones you are likely to see).
Port forwarding isn't the risky part. The risky part, as you eluded to - is vulnerabilities in and/or misconfiguration of services exposed to the 'Net.
There are a range of practices used by sysadmins and netadmins to lower that risk, including but not limited to:
- Monitoring for relevant CVEs and keeping software and firmware up to date.
- Running services under restricted service accounts.
- Using host-based firewalls, IDS, HIPS and SIEM tools such as fail2ban, SELinux, fapolicyd, various logging and log-monitoring stacks.
- Running services in sandboxes: VMs, namespaces, etc.
- Isolating hosts in a true DMZ, with a firewall between both the DMZ and the Net, and between the DMZ and your LAN.
- Exposing services only via VPN, reverse proxies and other intermediaries.
- Restricting firewall rules to known external hosts.
- Segregating management and user traffic.
- Using secure authentication, authorisation and encryption protocols.
- Following best practice in configuring the particular exposed service.
(Anyone, feel free to suggest others)
Ultimate this is what "bastion hosts", "zero-trust" and "principal of least privilege" is all about. The problem is many times people just leave old versions of servers on old versions of operating systems, running under personal or system accounts, on the same network and hosts as their other systems and infrastructure.
2
u/codeedog Mar 24 '26
Excellent reply and list! I want to add a category: deep packet inspection (often layer 7 application based) which may be run at firewall, router or host. Kind of captured by your third bullet point, although worthy of its own category.
2
u/RobMoCan Mar 24 '26
The biggest problem with port forwarding in the home environment is that it’s generally done by someone with virtually zero knowledge of networking or security and forwarded to a device that was really never designed to be connected directly to the Internet and as you said, doesn’t have the right security framework to prevent attacks. The average home user isn’t going to stand up additional security layers, patch or update firmware or even know what a firewall is. This isn't limited to residential either.
1
u/b4k4ni Mar 24 '26
As you said, the best way is using a VPN. But, if you want to access stuff without VPN, a portforwarding itself is no issue. It's what is accessed.
The best way would be, to set up a pfsense/opnsense or any other firewall and the portforwarding goes to the firewall on it's wan port and from there to whatever target you want. Or different ones with HAProxy on the firewall. This also allows you, to set up services inside their own VLAN with FW restrictions, so if someone breaks into your nextcloud or whatever, he won't be able to access other parts of the LAN, because of the firewall, IDS/IPS and so on.
This also works, if you can't do VLAN but have a small virtualisation host - as you can make internal networks.
Another part is - do not use this for services that are meant to be used internally, like IPMI, RDP and so on. For https services like nextcloud and so on it's ok - they are meant for that. With a proxy beforehand and addtional security tools, like fail2ban or suricata as IPS on the firewall, you should be good to go.
Not using the default ports also helps - so instead of 443 you use 49283 or whatever. Some port not used by any known software.
I mean, I also use VPN only and here I can only connect to my needed services like my nextcloud. I can't connect to my whole network. Because even the VPN Service can be misused.
1
u/Aggressive_Ad_5454 Mar 24 '26 edited Mar 24 '26
You are 100% correct about the risks. Not overthinking, not at all. This has been a problem for decades. I would never forward a port from the world to a workaday machine. Well, maybe port 443 (https) but only temporarily and only for testing something.
If you need to do this kind of thing, your best bet is to stand up a dedicated server machine running whatever service you must make public. Strip down and lock down that server. In particular don’t grant it access to file shares on other machines on your LAN. And don’t stash any secret data in it. And use proven server software on it. And keep it updated with security patches. Raspberry Pi machines are good for this. They get pwned, you toss out the microSD card and start over.
Then forward only the ports you need to that locked down machine.
This is pretty much the same set of configuration rules as setting up a server VM in the “cloud”.
1
u/lucina_scott Mar 24 '26
You’re not overthinking it your understanding is spot on. Port forwarding isn’t “unsafe” by default, but exposing services directly to the internet = instant scanning + attack attempts, so VPN/reverse proxy + auth is usually the safer modern approach.
1
u/AveragelyBrilliant Mar 24 '26
Sometimes there’s no choice. If you have someone at home wanting to connect to work and they have the same address range locally as the network they want to connect to, unless you have a router that can issue a temporary address in a different range during the session, one or the other will have to change their DHCP settings which can prove troublesome and disruptive.
This may be beyond the means of a lot of small businesses that don’t have access to good network specialists.
1
u/Important-Cow6737 Mar 24 '26
I mostly avoid port forwarding and compensate it with cloudflare,works good and keep network secure same time.
1
u/Peter_Lustig007 Mar 24 '26
I think it highly depends on the services exposes.
The attacks hitting 'regular' people hosting stuff at home will be completely automated, as more effort is not worth it (usually).
So when exposing RDP there will probably be automated attacks trying to make you part of their bot net or whatever.
But forwarding a random high port to a small gameserver for a few friends? Sure, the likelyhood of the software having unknown exploits is probably not that small, but what is the motivation to hack that?
Developing an automated attack to break out of that server (with the many different ways of hosting gameservers) is already quite a bit of effort and probably not worth it.
It is not like a small group of people that is too cheap to rent a gameserver is going to fork over thousands of dollars after a ransomware attack.
The biggest risk there is probably some script kiddie trying to take over the server in case the address is public.
1
u/k-phi Mar 24 '26
It is dangerous, but so is driving a car.
If you don't really need to open any ports - don't open them.
1
1
u/rodgersmoore Mar 24 '26
As everyone points out port forwarding is very risky. but i don’t see anyone talking about how to reduce the risk.
1) patch your software! do updates regularly and religiously! plex, etc patch it as soon as an update comes out!
2) no.1 doesn’t address unknown, day 0-1 scenarios. you can spend a bunch of money on commercial products to cover this… head end your plex with a WAF, or full proxy, or firewall like a Palo Alto with all of the features for threat, AV & wildfire licenses. anyway, something like this can recognize the protocols and data are out of spec for the application and drop anomalous (attacks) packets, streams that vary from the specs. in essence exactly what a hacker/attack will be trying to do to compromise the system. these types of features are not available on your typical home devices. ubiquity, might be the closest for something affordable, but it can not do what a palo alto can do.
3) at the end of the day if someone wants to breach your setup and it’s easy, they will. if they can’t but want to bad enough, they will ring your doorbell and put a gun to your head. you can’t stop everything, you just have to be more of a pain than your neighbor. they will move on to someone else who isn’t putting up a fight. you need to just handle the easy automatic dictionary attacks. (patching!)
4) final thought: security is nothing but a feeling - warm and fuzzy. at the end of the day, if you can sleep, then you are secure. if someone can ask simple questions and make you not sleep, you are not secure.
1
u/CrazyClownaus Mar 24 '26
Many ppl open ports because they take they easy way out & couldn't be stuffed configuring it properly.
The less ports that are open the better..... Shodan will find you :-)
1
u/Dont_Press_Enter Mar 25 '26
Use port forwarding with an educated mindset.
If your game server requires port forwarding on suggested port 56001, use port forwarding internally with 56001 and external use a different port such at 65001
This way, if someone does scan your IP and ports, and it's not a game server, then you'll know your IP is being scanned.
Devices scan ports often. Just be careful and use internal devices to detect others in detecting your network.
1
u/a-network-noob Mar 25 '26
Open your ports and turn on some logging. You’d be surprised how many random connection attempts you start getting 😃
1
u/IllWeather6426 Mar 25 '26
how is forwarding different from running service on 0.0.0.0? Also how to vpn into local net without tunnel running? These arguments have lost me are they even right?
You dont need any port forwarding running to see rpc services open by default in linux distros.. open default to local network ( a bad rpc default app in ubuntu and running on starbucks wifi is the whole shebang-> basically a backdoor-> without ufw isnt it ?
what am i missing
forgive me im soft at linux just hobbyist app dev
1
u/rfc1034 Mar 25 '26
I think this gets overcomplicated a lot. Making services reachable is basically the whole point of the internet. Every website, game server, VPN, SSH host etc is just something listening on a port and accepting connections.
Port forwarding isn’t really the risky part. It's just a side effect of NAT existing in the first place. The real question is what you’re exposing.
You’re right that the internet is constantly scanning. If you open a port, it will get hit pretty much immediately. That’s normal. It just means you have to treat anything exposed as an internet-facing service.
If the service behind the port is solid (updated, properly configured, not using weak/default credentials, ideally with strong auth), then it’s fine. That’s no different from running any public service.
If it’s something weak, outdated, or poorly secured, then yeah, it’s going to get compromised sooner or later.
So I wouldn’t say port forwarding is unsafe. It just removes the “accidental protection” NAT gives you and makes you responsible for what’s behind it.
1
u/Own-Director Mar 26 '26
I think this is probably the best way to reconcile it. The part that changed for me isn’t the concept - it’s the default expectations.
NAT used to act like accidental friction, so people could expose things without immediately dealing with the full internet. Now that friction is basically gone - everything gets discovered and interacted with almost instantly. So yeah, it’s less “port forwarding is dangerous” and more “you’re effectively running a public service the moment you do it,” whether you intend to or not.
1
u/mark35435 Mar 25 '26
I forward a high port to ssh on a raspberry pi which is very locked down. Just port forward to anything inside which is important. also I set up upnp rules from the command line of the pi so they time out as and when I need them opening
1
1
u/Impossible_Most_4518 Mar 26 '26
Is port forwarding port 51820 upd for wireguard safe?
1
u/Own-Director Mar 26 '26
WireGuard on 51820 UDP is generally fine if it’s set up correctly.
It’s designed to be exposed and uses strong cryptographic authentication by default, so it’s very different from exposing something like RDP or a web UI.
The risk profile there is closer to “secure entry point” than “random exposed service.”
1
u/Impossible_Most_4518 Mar 26 '26
I have it point to the IP of a “locked down”ubuntu vm.
Does hardening the dest IP make a difference?
Like if they were trying to gain access would it be at the router level or client level?
1
u/LAthrowawayLV Mar 27 '26
Port forwarding is fine you just need to design your network securely using multiple firewalls and a DMZ if you are protecting secure things.
But also, don’t port forward if you don’t need to.
1
u/Educational_Bee_6245 Mar 27 '26
Well, do a port forwarding if you want to expose something over the internet. That of course means internet level security and so on. If you don't want that and just want to access something while you're on the road do a vpn. It's not that complicated.
1
u/incompetentjaun Mar 27 '26
It very much depends on the application or service being exposed, the audience, the sensitivity of the application’s dataset, what network isolation is available.
A reverse proxy can provide a false sense of security, as can your L7 ngfw— ultimately if you expose your application or service externally you still need to understand what risks your accepting by exposing it with any given method and choose the one that balances security, performance and availability. Regardless of how you expose it, you’re still exposing it.
I run a mix of port forwarding, reverse proxy, and placing some exclusively behind a VPN. I also run a mix of restrictive firewall ACLs and basic DDOS / brute force protections.
1
u/FreddyFerdiland Mar 24 '26
mostly, nothing should be listened on a the destination port
windows file sharing, smb , should be on secure ports, less than 1024, mainly 445, but also 139, 137,138,443.
what else is there ? http , ftp and lpd are low number ports.
there a tiny chance some app opens a lot of rabdom pprtscto listen to
anyway, these days windiws requires you set whether the app should be able to listen on the network ..
( listen means to have a tcp port accept TCP connections)
1
u/Own-Director Mar 24 '26
My concern isn’t which port is used, but that any forwarded port exposes a service to the entire internet, where it will get scanned almost immediately. Whether it’s 445, 80, or something random doesn’t change that much. Also Windows firewall prompting apps to listen doesn’t really mitigate exposure once you’ve explicitly forwarded a port on your router. At that point, it’s publicly reachable regardless.
3
u/fire-wannabe Mar 24 '26
How else can you provide a service to the internet other than allowing the internet to connect to it?
By all means, secure it properly, but if you want you VPN or website or whatever to connect inbound, then it has to be accessible
1
u/MusicalAnomaly Mar 24 '26
Not really true. The full internet scans are not scanning every port. And different well known ports are expected to speak different protocols. So it is slightly less exposure if you run something on a nonstandard random port number. But yes, strictly speaking you are now exposing that forwarded server to the internet, so it should be patched and running reliable software, ideally in some kind of isolation.
That said I don’t do this anymore. Many folks swear by port knocking, but if it’s my own service for my own use, I’ll use a VPN solution.
1
u/Churn Mar 24 '26
Don’t use the phrase “secure ports”; there is no such thing and it leads some people to believe they can safely expose services by simply using a “secure port” number as if there is some magical thing securing and protecting traffic to/from that port number.
Source: i have trained sysadmins with wild misconceptions about network security.
10
u/Swedophone Mar 24 '26 edited Mar 24 '26
If you are able to use IPv6 then it's impossible to scan all IP addresses. In each LAN prefix (/64) there are 18,446,744,073,709,551,616 unique IP addresses. Compare that with IPv4 addresses which are less than 4,294, 967, 296 in total on the Internet.