Port Forwarding Config Generator

Common service port reference

Check the port number and the risk level before you forward anything. Do not expose the red ones straight to the internet: they either ship with no authentication at all, or getting them cracked hands over the whole machine.

Swipe the table sideways

No matching service — try a different keyword or port number.

Eight things to check before you hit save

The moment a port opens, your NAS joins the list every internet-wide scanner works through — and a fresh public IP usually gets its first probe within minutes. Work through these and almost every automated attack stops at the door. Your ticks are stored in your own browser.

1. Do not keep the default port 5000, 5001 and 8080 are the first thing every scanner tries. A random port above 10000 will not stop a targeted attacker, but it drops 99% of the bulk scanning. That is what the "random safe port" button above is for.
2. Forward HTTPS only, never HTTP Over HTTP your password travels in the clear all the way from the café Wi-Fi to your living room. Every NAS brand can issue a Let's Encrypt certificate — once it works, delete the HTTP forwarding rule.
3. Disable admin and use a different username Line one of every brute-force wordlist is admin; line two is root. Disable the default administrator and create one with a name nobody would guess — now the attacker has to guess a username *and* a password.
4. Turn on two-factor authentication The single best return on effort here. Even if your password leaks somewhere else and gets replayed, without the six digits nobody gets in. Every mainstream NAS OS has it built in — scan a QR code and you are done.
5. Set up auto-block on failed logins Five failures, one hour ban. This is what decides whether an attacker gets ten million attempts or five — the most direct switch you have against brute force. Synology calls it Auto Block, QNAP calls it Connection Protection; elsewhere look under security settings.
6. Do not forward SSH, SMB or database ports 22, 445, 2049, 3306, 6379 have no business facing the internet. If you genuinely need remote file shares or a database, connect the VPN first and use the LAN address — one extra step, one fewer way to get ransomed.
7. Restrict by source IP or country If you only ever connect from one country, limiting access to it removes most scanning traffic outright. If you work from a fixed location, allowlisting that single egress IP is even simpler.
8. Come back and test once it is live A correct rule is not a working rule. A blocked port, carrier-grade NAT upstream, or a firewall that never allowed it will all fail silently. Use "test port connectivity" above to dial in from the public internet — far more meaningful than opening it from your own LAN.

All eight cleared. The only thing left is to actually read your login log now and then.

Before you open anything: four ways in

Port forwarding is the quickest route, but it is not always the right one — least of all when you have no public IPv4 to begin with. Each of these four costs you something different. Read before you configure.

Swipe the table sideways

Not sure which case you are in? Run the NAT type test to find out whether you are stuck behind carrier-grade NAT, then the IPv6 connectivity test to see if IPv6 actually works. Answer those two and the choice above makes itself.

Tools that pair well with this one

FAQ