# Wi-Fi bridge Port forwarding

<section id="bkmrk-this-functionality-r"><p class="callout info">**This functionality requires SLZB-OS v3.4.5.dev0 or higher.**</p>

In **NAPT** bridge mode SLZB runs a separate Wi-Fi network and gives its devices internet access over its own Ethernet or 4G/LTE connection (for Ultima3 with LTE addon). The devices themselves stay behind NAPT and nothing outside can reach them.

Port forwarding opens one service of such a device. You choose an **external port** on SLZB, and SLZB passes everything that arrives on it to the chosen **client port** of a Wi-Fi client. This way you can open, for example, the web interface of device that lives in the SLZB Wi-Fi network.

Rule `TCP 8080 → 192.168.4.2:80`: a request to port **8080** of SLZB reaches port **80** of the Wi-Fi client **192.168.4.2**.

</section><section id="bkmrk-requirements-u-devic">## Requirements

- **U device**.
- **Wi-Fi bridge enabled**: 
    - <span class="path"><span class="ui">Mode</span><span class="sep">›</span><span class="ui">Ethernet to Wi-Fi bridge</span></span>, bridge type <span class="ui">NAPT</span>;
    - or, on the <span class="ui">4G/LTE</span> page, <span class="ui">Enable 4G/LTE Internet to Wi-Fi bridge mode</span>.
- **For access through a VPN**: WireGuard or Tailscale enabled on the <span class="ui">VPN</span> page.

</section><section id="bkmrk-setup-open-the-mode-">## Setup

1. Open the <span class="ui">Mode</span> page and scroll to the <span class="ui">Port forwarding</span> card below the bridge settings.
2. Check the top row of the card: <span class="ui">Wi-Fi bridge (NAPT)</span> should be <span class="badge b-ok">Active</span>, and <span class="ui">Ethernet / LTE address</span> and <span class="ui">VPN address</span> show the addresses you will connect to.
3. Connect the device you need to the SLZB Wi-Fi network. It appears in the suggestions of the <span class="ui">Wi-Fi client</span> field.
4. Click <span class="ui">Add rule</span> and fill in the row (see *Rule fields*).
5. Click <span class="ui">Save</span>. The rule takes effect within a few seconds, no reboot needed. The <span class="ui">Status</span> column shows the result.

</section><section id="bkmrk-rule-fields-field-wh">## Rule fields

[![image.png](https://smlight.tech/support/manuals/uploads/images/gallery/2026-10/scaled-1680-/z8rimage.png)](https://smlight.tech/support/manuals/uploads/images/gallery/2026-10/z8rimage.png)

<div class="table-wrap"><table><thead><tr><th>Field</th><th>What to enter</th></tr></thead><tbody><tr><td>Checkbox</td><td>The rule is enabled. A disabled rule is kept but has no effect.</td></tr><tr><td>Name</td><td>Any label up to 23 chars, for example "Garage camera".</td></tr><tr><td>Protocol</td><td><code>TCP</code> (web and most services), <code>UDP</code> or <code>TCP&#43;UDP</code>.</td></tr><tr><td>Interface</td><td><span class="ui">Ethernet / LTE</span>: access from your local network (or from the LTE side).

<span class="ui">VPN</span>: access through the WireGuard / Tailscale tunnel.

</td></tr><tr><td>External port</td><td>The port of SLZB you will connect to: <code>1–49151</code>.</td></tr><tr><td>Wi-Fi client</td><td>The client's IP (<code>192&#46;168&#46;4&#46;2</code>) or MAC (<code>a4&#58;cf&#58;12&#58;3b&#58;9e&#58;01</code>). You can pick it from the suggestions of connected clients.</td></tr><tr><td>Client port</td><td>The port of the service on the client itself: <code>1–65535</code>.</td></tr></tbody></table>

</div><p class="callout info"><span class="t">**IP or MAC**  
Clients get their address from DHCP, and it can change after they reconnect.  
A rule with a **MAC** finds the client's current IP by itself; it is shown next to the status.  
A rule with an **IP** suits a client with a static address.  
</span></p>

</section><section id="bkmrk-examples-device%27s-we">## Examples

### Device's web interface from your home network

<div class="examples"><div class="ex"><div class="rule">TCP · Ethernet / LTE · 8080 → a4:cf:12:3b:9e:01 : 80</div></div></div>Open <code>http&#58;&#47;&#47;&#60;SLZB Ethernet address&#62;&#58;8080</code> in a browser on a PC in the same network.

### The same device through Tailscale or WireGuard

<div class="examples"><div class="ex"><div class="rule">TCP · VPN · 8081 → a4:cf:12:3b:9e:01 : 80</div></div></div>Open <code>http&#58;&#47;&#47;&#60;SLZB VPN address&#62;&#58;8081</code>, for example <code>http&#58;&#47;&#47;100&#46;101&#46;40&#46;68&#58;8081</code>, from any device of your tailnet or VPN network.

### Both ways at once

Create two rules as above with **different** external ports (8080 and 8081). One external port cannot serve both Ethernet and VPN.

</section><section id="bkmrk-rule-status-status-m">## Rule status

<div class="table-wrap"><table><thead><tr><th>Status</th><th>Meaning</th><th>What to do</th></tr></thead><tbody><tr><td><span class="badge b-ok">Active</span></td><td>The rule is in effect.</td><td>—</td></tr><tr><td><span class="badge b-off">Disabled</span></td><td>The rule's checkbox is cleared.</td><td>Enable it and save.</td></tr><tr><td><span class="badge b-warn">Wi-Fi bridge (NAPT) is not running</span></td><td>The bridge is off or in transparent mode.</td><td>Enable the NAPT bridge (see *Requirements*).</td></tr><tr><td><span class="badge b-warn">No address on this interface</span></td><td>No Ethernet / LTE address, or the VPN is not connected.</td><td>Check the network or the VPN page.</td></tr><tr><td><span class="badge b-warn">Client not found (no DHCP lease)</span></td><td>No device with this MAC got an address in the SLZB network.</td><td>Connect the client to the SLZB Wi-Fi, check the MAC.</td></tr><tr><td><span class="badge b-bad">Not in the Wi-Fi bridge network</span></td><td>The IP does not belong to the SLZB Wi-Fi network.</td><td>Use an address of the network shown in "Wi-Fi network".</td></tr><tr><td><span class="badge b-bad">Port is used by SLZB</span></td><td>A service of SLZB itself runs on this external port.</td><td>Choose another external port.</td></tr><tr><td><span class="badge b-bad">Too many rules</span></td><td>The internal forwarding table is full.</td><td>Disable or delete rules you do not need.</td></tr><tr><td><span class="badge b-off">…</span></td><td>The rules were just saved and not checked yet.</td><td>Wait a few seconds.</td></tr></tbody></table>

</div></section><section id="bkmrk-limitations-up-to-10">## Limitations

- **Up to 10 rules.** A `TCP+UDP` rule counts as one.
- **External ports 1–49151.** Higher ports are used by the NAPT bridge itself.
- **One rule, one interface.** A rule with <span class="ui">Ethernet / LTE</span> does not work through the VPN, and the other way round. For both, create two rules with different external ports.
- **SLZB's own ports are never forwarded:** the web interface (`80`), the Zigbee radio TCP ports (`6638` by default) and other services of the device. Such rules get the status <span class="badge b-bad">Port is used by SLZB</span>.
- **Ethernet / LTE means the active uplink.** When SLZB fails over from Ethernet to backup LTE, the rules move to the LTE address within a few seconds.
- **From inside the SLZB Wi-Fi network** a forwarded port cannot be reached on the external address of SLZB. Wi-Fi clients reach each other directly at their `192.168.4.x` addresses.
- **Mobile internet:** SLZB on LTE usually cannot be reached from the internet (carrier CGNAT). Use the VPN.
- **A factory reset** deletes all rules.

</section><section id="bkmrk-security-every-rule-">## Security

<p class="callout warning">Every rule opens a service of a Wi-Fi client to anyone who can reach that address of SLZB.</p>

- Forward only the ports you need, and disable rules you do not use.
- Protect the client's own web interface with a password: SLZB does not check who connects.
- For access from outside your home, prefer the <span class="ui">VPN</span> interface to opening ports on your router.
- With Tailscale, access to SLZB follows your tailnet's access policy (ACL).

<p class="callout info"><span class="t">**The port is open one way on the other side too.**  
Incoming packets to a rule's external port reach the client from any interface, but replies only go out through the chosen one. A TCP connection from the other side never completes, but UDP packets towards the client do get through. Keep this in mind for UDP services.  
</span></p>

</section><section id="bkmrk-09troubleshooting-th">## <span class="n">09</span>Troubleshooting

<details><summary>The status is "Active", but the page does not open</summary>

Make sure you connect to the address of the interface chosen in the rule: the Ethernet / LTE address for <span class="ui">Ethernet / LTE</span>, the VPN address for <span class="ui">VPN</span>. Check that the service on the client listens on the client port and that the client's own firewall allows the connection.

</details><details><summary>The rule stopped working after the client reconnected</summary>

The client got a new IP from DHCP. Use its MAC in the rule instead of the IP, and SLZB will find the current address by itself.

</details><details><summary>It works over Ethernet but not through the VPN</summary>

Check the VPN status on the <span class="ui">VPN</span> page and that the rule uses the <span class="ui">VPN</span> interface. With Tailscale, check that your tailnet's ACL allows connections to this port of SLZB.

</details><details><summary>Red text below the buttons about a damaged file</summary>

The rule file on the device could not be read, and the rules are not in effect. Check the rules in the table and save them again; the file is rewritten.

</details><details><summary>Saving fails with an error about the same external port</summary>

Two enabled rules use the same external port with overlapping protocols. Change the port of one of them.

</details></section>