Public entry point, mapped to the service port.
For each rule, specify the Gateway listening port, target terminal, target IPv4 address and service port. Explicit mappings route external connections to the corresponding service.
Open a port. Connect to the specified service.
Forward a public port on the dedicated Gateway through the dedicated Relay to a terminal service connected to the Connector, exposing only explicitly configured mappings.
Learn about service mappingOpen only the service you need.
TCP and UDP, specified separately.
Choose TCP, UDP or both protocols according to the service's needs. Different protocols are forwarded separately; for services that require different target ports, add separate rules.
Disable the service, remove the matching mapping.
The dedicated firmware disables forwarding by default; connections are forwarded only after an explicit rule is added. When you delete one service mapping, the other rules are retained.
The target service follows the terminal configuration.
Download the dedicated Relay’s endpoint configuration, import it into the service host or router and connect to the dedicated Connector. Then select the corresponding WireGuard or IPsec endpoint as the target.
dedicated nodes at both ends
Both the Gateway and the Connector run the dedicated firmware for port forwarding, and a dedicated Relay in an available state has been established.
an explicit target scope
The target uses a private IPv4 address, which must be the tunnel address of the selected terminal or belong to an internal subnet already registered in this configuration.
an available listening port
The system rejects port conflicts and reserved listening ports. Node service ports such as SSH, HTTPS and IPsec cannot be used as forwarding ingress.
Dedicated terminal configurations for WireGuard, RouterOS or FortiGate only establish the service tunnel and retain the device's existing default route. Target services still need to configure their own authentication and access control, and the customer network must also allow the corresponding forwarding and return traffic.
Learn about device configuration →Frequently asked questions.
Does enabling Dedicated Mode already expose public services?
No. After enabling dedicated firmware on both ends and establishing a dedicated Relay, you must still add an explicit port mapping. Simply switching a node's purpose does not automatically expose services.
Can traffic be forwarded directly to any public IP address?
No. The destination must be a private IPv4 address and must belong to the tunnel address of the selected terminal or a registered internal network segment. What is exposed here is a mapping for a specific service, not authorization for external access to an entire internal network.
Can an existing node's purpose be switched directly?
Before switching, first remove the Relay associated with the node; switching is not possible while the version is locked. Connections may be interrupted during dedicated firmware installation, and both ends require the corresponding dedicated firmware.