Port forwards published to the internet: why every one needs a review

What the audit found

Your configuration contains dst-nat rules under IP → Firewall → NAT that forward traffic arriving from the internet to devices on your internal network, and the rules do not restrict which source addresses may use them. The ports involved are not on the list of services the audit considers high-risk — those are reported separately — so this entry is informational.

It is reported whenever at least one such forward exists. The audit rates it info because a port forward is a deliberate decision, not a mistake; the point is to make sure each one is still a decision you would make today.

Why it matters

A port forward takes a device that was protected by your firewall and puts one of its services directly on the internet. From that moment on, the security of your network depends on the security of that device and that service: its software version, its password, its own logging. The router no longer filters anything for it beyond the port number.

The usual way this becomes a problem is not the forward you set up last month, but the one from three years ago. A camera that was replaced but whose rule stayed; a game server for a child who has moved out; a test of a home automation dashboard that was never removed; a NAS whose web interface was opened "temporarily". The device behind the rule stops getting updates, or is repurposed, or the address is reassigned by DHCP to something else entirely — and the forward keeps working, now pointing at a device that was never meant to be public.

Scanners find forwarded ports the same way they find any other open port, and consumer devices behind them are a frequent entry point into networks that otherwise have a sound firewall. This finding is not saying your forwards are wrong. It is saying they should be listed, understood and periodically pruned.

What it looks like in Winbox

Open IP → Firewall → NAT and look at rows where Chain is dstnat and Action is dst-nat or netmap. For each, note the Dst. Port, the To Addresses and To Ports, and whether the Src. Address or Src. Address List column is empty. An empty source restriction means the forward is open to everyone. The Comment column is where you should find a description of what the rule is for — if it is blank, that is a sign the rule has not been reviewed.

How to fix it

There is no single fix, because the correct action depends on each rule. Go through the list under IP → Firewall → NAT and, for every forward, answer three questions: what is behind it, is it still needed, and who needs to reach it.

If it is no longer needed, remove it. Disabling is a reasonable first step if you are not sure; delete the rule once nothing has broken after a few weeks.

If it is needed by known people or systems, restrict the source: an address list under IP → Firewall → Address Lists holding the allowed remote addresses, referenced from the rule's Src. Address List field. The forward then ignores connections from anywhere else.

If it is needed by you from arbitrary locations, consider replacing it with a VPN. WireGuard on RouterOS 7 needs one open UDP port instead of several TCP ones and puts authentication in front of every internal service at once.

In every case, add a comment saying what the rule is for and when you last checked it, and verify that the internal device still has the address the rule points to — a static DHCP lease is the usual way. None of this can lock you out of the router, so Safe Mode is optional, but a wrong source restriction can cut off a remote user, so test after each change. Afterwards, check from outside your network that removed ports no longer answer and restricted ports answer only from the allowed addresses, then re-run the audit; the finding disappears once no forward is open to the whole internet.

The full MKRouterKit report lists every published forward with its target and source restriction, so you can review them in one place.

FAQ

The audit says info. Do I really need to do anything?

Not urgently, and perhaps nothing at all if every forward is current and intentional. The finding is a prompt to look, not a defect. Spending ten minutes checking the list once or twice a year is the whole recommendation.

I run a web server at home. Restricting the source is not possible.

Correct — a public web server has to accept connections from anyone. In that case the forward stays open and the security burden moves to the server: keep it updated, expose only the ports it needs (usually 80 and 443, not the admin panel), and put it in a separate VLAN so a compromise cannot reach the rest of your network.

Does a non-standard external port help?

A little, against the laziest scanners, and not at all against the rest. Port scanners test the full range and identify the service by its response. Use whatever port is convenient, but do not count it as protection.