TCP Port Forwarding on a NAT VPS: Public and Private Ports

A TCP port mapping forwards connections from an assigned public IPv4 port to a TCP port inside your VPS. The public and private port numbers can differ; clients must use the public endpoint displayed for your instance.

An example mapping

Public 203.0.113.10:24080 might forward to private 10.0.0.5:8080. These documentation addresses are examples. A client would visit http://203.0.113.10:24080, while the application listens on guest port 8080.

The destination address must be reachable by the guest's network, normally by binding to 0.0.0.0 or the appropriate guest interface. A process listening only on 127.0.0.1:8080 is not normally reachable from outside the guest.

Check each layer

1. Confirm that the process is running.
2. Inspect the listening TCP socket with `ss -lnt`.
3. Test the application inside the VPS.
4. Confirm that the guest firewall permits the private destination port.
5. Check the mapping's protocol, private port and public endpoint in the panel.
6. Test from a separate external network.

Do not assume that connecting from the guest to its own shared public endpoint works; NAT loopback support varies. Use an external test before diagnosing a mapping failure.

Keep mappings intentional

Only expose services that need inbound access, with authentication and encryption where appropriate. One TCP mapping does not also create a UDP mapping. Use the instance's actual port allowance rather than copying an example quota.

See UDP forwarding, mapping troubleshooting and SSH via assigned ports.

Reference: RFC 5737: documentation addresses.