Port forwarding

Port forwarding is a rule on a router or firewall that sends traffic arriving on one of its public ports to a device behind it. It’s the usual way to make a home server or office machine reachable from the internet. It also exposes that service to anyone who finds the port, and it has to be set up on every router in the way, which isn’t possible behind carrier-grade NAT or on networks you don’t control.

Managed Nebula hosts don’t need it

Ordinary hosts on a Managed Nebula network never need a port opened or forwarded. Each host connects out to the network’s lighthouses, which tell hosts how to reach each other. Two hosts behind different routers then open a direct path by sending packets toward each other at the same time (NAT traversal). When that can’t work, for example behind symmetric NAT, their traffic goes through a relay instead.

A service on a host, like SSH or a database, can be reached by the other hosts its firewall rules allow, and isn’t reachable from the internet at all.

When you do open a port

Lighthouses and relays have to be reachable by every host. If you run your own, give it a public IP address and open its UDP port to the internet. Lighthouses use port 4242 unless you pick a different one when you create them (see Enrolling a lighthouse).

Most networks can skip even that. Every new network comes with a managed lighthouse run by Defined Networking, which also acts as a relay by default.