Port Forwarding and Firewall
Two tabs for the same subject: what the outside world is allowed to reach inside the cafe. Most cafes need the first one for their consoles and never open the second.
Why a console wants a port
A console that cannot be reached from outside reports a strict NAT type, and strict NAT is what is behind "I can't join my friend's party" and "voice chat doesn't work". Opening a port for that console fixes it.
Port forwarding
A forward says: traffic arriving on this port from the internet goes to this device inside the cafe.
Each forward carries the line it applies to, the protocol, the port the outside uses, and the device and port inside. Two forwards cannot use the same port on the same line, which is also the reason a cafe with several consoles usually wants the next section instead.
A forward pointed at a device with no fixed address breaks as soon as that address changes. Give the console a fixed address first, then forward to it.
Letting consoles open their own
With UPnP on, a console asks the gateway for a port itself and reports an Open NAT type once it has one. No list to keep, and it survives the console being moved to another station.
The trade is that anything else on those machines can ask too. Keep it to the groups that need it, which in practice means the console group and not the stations.
On Windows, if consoles cannot find the gateway, it is usually the SSDP Discovery service holding the port they search on. Stop that service and apply again.
Firewall rules
The gateway already blocks what should be blocked. Rules are for the cafe that needs something specific: an office PC reachable from home, a station kept away from the rest of the network, a service that must not leave the building.
Two things decide how a rule behaves:
- Order. Rules are checked from top to bottom and the first one that matches decides. A broad rule above a narrow one makes the narrow one dead.
- Direction. A rule on the LAN side is about traffic leaving the cafe. A rule on the WAN side is about traffic arriving.
Aliases
An alias names a list of addresses or ports so rules can use it. Write "office PCs" once and use it in four rules, rather than four copies of the same three addresses that drift apart over a year.
Reaching the cafe by name
If the cafe's address changes whenever the modem reconnects, dynamic DNS keeps a name pointed at it. Set it up with your provider's updater key, not your account password, and the gateway keeps the name current.
This is how a forward stays useful to somebody connecting from outside: the address moves, the name does not.