Wi-Fi bridge Port forwarding

This functionality requires SLZB-OS v3.4.5.dev0 or higher.

In NAPT bridge mode SLZB runs a separate Wi-Fi network and gives its devices internet access over its own Ethernet or 4G/LTE connection. The devices themselves stay behind NAPT and nothing outside can reach them.

Port forwarding opens one service of such a device. You choose an external port on SLZB, and SLZB passes everything that arrives on it to the chosen client port of a Wi-Fi client. This way you can open, for example, the web interface of device that lives in the SLZB Wi-Fi network.

Rule TCP 8080 → 192.168.4.2:80: a request to port 8080 of SLZB reaches port 80 of the Wi-Fi client 192.168.4.2.

Requirements

• U device.
• Wi-Fi bridge enabled:
  • Mode›Ethernet to Wi-Fi bridge, bridge type NAPT;
  • or, on the 4G/LTE page, Enable 4G/LTE Internet to Wi-Fi bridge mode.
• For access through a VPN: WireGuard or Tailscale enabled on the VPN page.

Setup

1. Open the Mode page and scroll to the Port forwarding card below the bridge settings.
2. Check the top row of the card: Wi-Fi bridge (NAPT) should be Active, and Ethernet / LTE address and VPN address show the addresses you will connect to.
3. Connect the device you need to the SLZB Wi-Fi network. It appears in the suggestions of the Wi-Fi client field.
4. Click Add rule and fill in the row (see Rule fields).
5. Click Save. The rule takes effect within a few seconds, no reboot needed. The Status column shows the result.

Rule fields

IP or MAC
Clients get their address from DHCP, and it can change after they reconnect.
A rule with a MAC finds the client's current IP by itself; it is shown next to the status.
A rule with an IP suits a client with a static address.

Examples

Device's web interface from your home network

Open http://<SLZB Ethernet address>:8080 in a browser on a PC in the same network.

The same device through Tailscale or WireGuard

Open http://<SLZB VPN address>:8081, for example http://100.101.40.68:8081, from any device of your tailnet or VPN network.

Both ways at once

Create two rules as above with different external ports (8080 and 8081). One external port cannot serve both Ethernet and VPN.

Rule status

Limitations

• Up to 10 rules. A TCP+UDP rule counts as one.
• External ports 1–49151. Higher ports are used by the NAPT bridge itself.
• One rule, one interface. A rule with Ethernet / LTE does not work through the VPN, and the other way round. For both, create two rules with different external ports.
• SLZB's own ports are never forwarded: the web interface (80), the Zigbee radio TCP ports (6638 by default) and other services of the device. Such rules get the status Port is used by SLZB.
• Ethernet / LTE means the active uplink. When SLZB fails over from Ethernet to backup LTE, the rules move to the LTE address within a few seconds.
• From inside the SLZB Wi-Fi network a forwarded port cannot be reached on the external address of SLZB. Wi-Fi clients reach each other directly at their 192.168.4.x addresses.
• Mobile internet: SLZB on LTE usually cannot be reached from the internet (carrier CGNAT). Use the VPN.
• A factory reset deletes all rules.

Security

Every rule opens a service of a Wi-Fi client to anyone who can reach that address of SLZB.

• Forward only the ports you need, and disable rules you do not use.
• Protect the client's own web interface with a password: SLZB does not check who connects.
• For access from outside your home, prefer the VPN interface to opening ports on your router.
• With Tailscale, access to SLZB follows your tailnet's access policy (ACL).

The port is open one way on the other side too.
Incoming packets to a rule's external port reach the client from any interface, but replies only go out through the chosen one. A TCP connection from the other side never completes, but UDP packets towards the client do get through. Keep this in mind for UDP services.

09Troubleshooting