My computer has a VPN running, but I have an SSH tunnel forwarding traffic on port 8000 to its router (Ubiquiti Edgemax) through which I can route traffic in order to circumvent the VPN.

I have a service running on two ports on this machine, 9001 and 9002, that needs to be able to take incoming connections from the internet. I have set up similar SSH tunnels to the router.

When I portscan my router's IP from the internet, it says those ports are closed. When I look up articles, people are concerned with forwarding the port (say, to my client machine) when I'm actually going the other way. I think I need to open 9001 and 9002 on the firewall of the router itself.

How do I open the firewall for these two ports on my Ubiquiti Edgemax?

  • Why do you believe there is a difference between forwarding a port on a firewall and opening the port? The only way to avoid forwarding a specific port to a specific device is to use DMZ to a device on the network. – Ramhound Jun 22 at 23:55
  • @Ramhound my question might be malformed due to lack of knowledge, but I still don't know how I would solve the problem. How do I make the port scan show that the port is open on my public IP and run the service on this machine without dropping the VPN? the other tunnel totally works for browsing or whatever btw... – Walrus the Cat Jun 23 at 0:23

First off, A port is open because a process is listening on it, and there is a network pathway between the client and the service.

As such, unless you are talking about a service being hosted on the router itself, it cannot "open a port". The router can block what would otherwise be an open port (that's kind of its job in most home use-cases), but it cannot do anything more than allow traffic on the path.

Also note, forwarding a port to a IP that doesn't have a processes on that port does not cause a port to become open either. The thing that makes it "open" is that there is a service listening there. otherwise it doesn't matter if the port is made inaccessible by NAT or by the internal host itself; its closed either way, just from different perspectives.

Secondly, what people call port-forwarding, is technically called DNAT. what you describe is a DNAT scenario (as opposed to an SNAT scenario, where you are connecting outbound from the LAN; SNAT is uncommon in home networking, beyond the automatic mechanisms of stateful NAT).

So to make your service accept incoming connections from the internet, you need to have the three elements; a Process, a Port, and a Pathway.

  1. create a forwarding rule for each port, accepting traffic from the WAN, and forwarding to your internal host on 9001 ad 9002. EdgeOS has a reasonably good interface for creating forwarding rules.
  2. Allow traffic incoming on that port from the Internet in your Firewall. in EdgeOS terms, place a ruleset on the WAN interface with a direction of "IN" and a rule to accept New and Established-state traffic destined for the port.
  3. verify that the service is listening on or another suitable network interface ( will not work). you can check which interface your service is bound to with netstat -ntlup (linux) or netstat -abno | findstr LISTENING (powershell as admin), and looking at the local IP address. if its or an IP on your LAN, it should work.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.