Skip to main content
The port forwarding tools let you manage NAT rules that map inbound traffic on a WAN port to an internal IP address and port. You can read the current ruleset without any confirmation and use the write tools to expose services, modify existing rules, or remove port forwards that are no longer needed. Each rule maps a single external port (or port range) to a specific internal destination.
create_port_forward, update_port_forward, and delete_port_forward all require confirm=True. Opening ports on your WAN interface increases your attack surface. Always use dry_run=True to review the rule before applying it, and restrict the src field to specific IP ranges when possible.

​
Tools

​
list_port_forwards

Returns all port forwarding rules configured in the site. This is a read-only operation.
​
string
required
The site identifier to query.
​
integer
Maximum number of rules to return.
​
integer
Number of rules to skip, for pagination.

​
create_port_forward

Creates a new port forwarding rule. The external WAN port (dst_port) is mapped to an internal IP and port (fwd_ip and fwd_port). Both the destination port and the forward-to IP are validated before the rule is submitted.
​
string
required
The site identifier where the rule will be created.
​
string
required
A descriptive label for the rule (e.g. "Home Assistant").
​
integer
required
The external (WAN) port to listen on. Must be a valid port number (1–65535).
​
string
required
The internal (LAN) IP address to forward matching traffic to. Must be a valid IPv4 address.
​
integer
required
The internal port on fwd_ip to forward to. Must be a valid port number (1–65535).
​
string
The protocol to match. Accepted values: tcp, udp, tcp_udp. Defaults to tcp_udp.
​
string
Restricts the rule to traffic from a specific IP address or CIDR block. Use "any" (the default) to allow traffic from all sources.
​
boolean
Whether the rule is active immediately after creation. Defaults to true.
​
boolean
Write matched traffic to the firewall log. Defaults to false.
​
boolean
required
Must be true to create the rule.
​
boolean
When true, validates all parameters and returns the rule payload without creating anything.
Example: forwarding external port 8080 to an internal web server
If you only need a specific external IP to access the forwarded port (for example, a remote office or your own IP), supply that address or CIDR in the src parameter. This limits exposure without needing a separate firewall rule.

​
update_port_forward

Modifies an existing port forwarding rule using a fetch-then-merge strategy. Only the fields you provide are changed; all other settings are preserved.
​
string
required
The site identifier where the rule lives.
​
string
required
The internal ID of the rule to update. Use list_port_forwards to find this value.
​
string
New rule name.
​
integer
New external (WAN) port.
​
string
New internal destination IP address.
​
integer
New internal destination port.
​
string
New protocol: tcp, udp, or tcp_udp.
​
string
New source restriction. Use "any" to remove a previous restriction.
​
boolean
Enable or disable the rule without deleting it.
​
boolean
Enable or disable logging for the rule.
​
boolean
required
Must be true to apply changes.
​
boolean
When true, returns a preview without writing changes.

​
delete_port_forward

Permanently removes a port forwarding rule. The tool verifies the rule exists before deleting it and raises ResourceNotFoundError if the ID cannot be found.
​
string
required
The site identifier.
​
string
required
The internal ID of the port forwarding rule to delete.
​
boolean
required
Must be true to delete the rule.
​
boolean
When true, confirms the rule exists and returns a preview without deleting.
If you want to temporarily suspend a port forward without losing the configuration, use update_port_forward with enabled=false instead of deleting the rule.