Port forwarding
Port forwarding is a router setting that sends a particular kind of traffic arriving from the internet on to one chosen device inside your network, such as a CCTV recorder. For Cyber Essentials each forward is an inbound firewall rule: it needs a documented business need and approval (A4.8), and unauthenticated access must stay blocked (A4.7).
- Term
- Port forwarding
- Also known as
- Port mapping, Opening a port, Virtual server rule
- Category
- Networks and firewalls
- Requirement area
- 1. Firewalls
- Reviewed against
- Requirements v3.3
What does the term port forwarding mean in Cyber Essentials?
Port forwarding is a router setting that sends a particular kind of traffic arriving from the internet on to one chosen device inside your network, such as a CCTV recorder.
How does port forwarding apply to Cyber Essentials?
In plain terms
Your router normally turns away anyone knocking from the internet. Port forwarding is an instruction to let one kind of visitor through and walk them straight to a particular desk. People set it up so they can view CCTV from home, reach a file server, or let a supplier connect to a till system. Routers sometimes call it "virtual server" or "NAT rule".
What Cyber Essentials asks
The question set describes this as making "a system on the inside" accessible from the internet, "sometimes referred to as 'opening a port'", and says "You need to show a business case for doing this because it can present security risks" (A4.5 and A4.8). The requirements then apply:
- block unauthenticated inbound connections by default (A4.7)
- approve and document each inbound rule with its business need (A4.8)
- remove or disable rules when they are no longer needed (A4.6)
The device you forward to becomes internet-facing. If it gives access to data that should not be public, A5.4 to A5.7 ask how users are authenticated and protected against password guessing.
Common mistakes
- Forwards created by an installer, for example for CCTV or a phone system, that nobody in the business knows about.
- Features that open ports automatically, such as UPnP, left switched on. Check the router's forwarding table, not just your notes.
- Forwarding straight to remote desktop rather than using a VPN.
See the firewall requirements and A4.8. Related: port, NAT.
Related terms
- Remote Desktop Protocol (RDP)Remote Desktop Protocol (RDP) is Microsoft's way of letting someone see and control a Windows computer or server from another device over a network.
- VPN (virtual private network)A VPN, or virtual private network, is an encrypted link over the public internet that lets a device or office connect to another network as if it were plugged in there.
- Port (network port)A port is a numbered doorway on a device that a particular kind of network traffic uses, for example secure web pages usually arrive on port 443.
- NAT (network address translation)NAT, network address translation, is the way a router lets many devices on your network share one public internet address by swapping addresses as traffic passes through.
- RouterA router is the box that connects your office or home network to the internet and passes traffic between the two.
- Software firewallA software firewall is a firewall configured on a device that works like a boundary firewall but only protects the single device on which it is configured.
Frequently asked questions
Port forwarding is a router setting that sends a particular kind of traffic arriving from the internet on to one chosen device inside your network, such as a CCTV recorder.
In the 2026 Danzell question set, port forwarding comes up at A4.5, A4.7, A4.8. Read those questions against the definition above so your answers use the term the way the assessor will.
Port forwarding relates to 1. Firewalls in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.