The WAN (corporate network) and LAN (machine network) side of the edge gateway are separated by the internal firewall. However, you can allow local WAN to LAN traffic by adding a port forwarding. This way you can access the machine, from inside the local corporate network, without having to establish a VPN connection first. For security reasons, port forwarding does not work for the cellular connection. This is to prevent your machine from being directly exposed to the internet.

How it works: when you are inside the local corporate network, you access the  edge gateway's WAN IP address at a specific network port (e.g. 5900 for VNC traffic). The edge gateway's port forwarding will then forward the network traffic to a target IP address and network port, resulting in a connection with the target device (PLC, HMI, or other).

Port forwarding or 1:1 NAT, what's the difference?

There are technical differences between the two, but 1:1 NAT and Port forwarding both serve the same purpose: being able to connect to the machine from inside the local corporate network. The most important differences are compared below.

Communication port
If you're unsure which communication port is used or if multiple ports are used, 1:1 NAT is easier to configure. With Port forwarding, you are required to specify a communication port, which only allows traffic through that uses that port. With 1:1 NAT, you are allowed to specify a communication port, but you are not required to.

Multiple devices
If you're looking to communicate with with more than 1 device behind the edge gateway, it's again easier to set this up using 1:1 NAT. With Port forwarding, each rule requires the use of a different external port. This in turn means that your computer's software needs to use a custom port to communicate with the other devices behind the edge gateway. With 1:1 NAT, this is not required and your software can just use its default communication port.

Configure port forwarding

Select one of the configuration methods below.

• IXON Cloud
• Local web interface

IXON Cloud

The next steps show you how to add port forwarding via the IXON Cloud.

1. Before you start, make sure to set a static WAN IP address to maintain long-term accessibility.
2. Go to Fleet Manager > Devices and click on your device name.
3. Go to Network > Firewall.
4. Under WANLAN, click on Add port forwarding.
   • If you're using a SecureEdge or SecureEdge Pro edge gateway, rules can be added per WAN port, depending on how you have your edge gateway connected to the local corporate network. To add rules for the OT/LAN port, when it's configured as WAN2, go to WAN2LAN instead.
5. Enter the requested information (details below) and click on Add.

   Field	Description
   Source port	All incoming network traffic at this port (at edge gateway's WAN) will be forwarded. The port number is application dependent. For example, VNC applications use port 5900 by default. Search online or contact the manufacturer for the correct port number. Tip: If you're adding port forwarding for more than one VNC server, simply increase the source port by 1 for each port forwarding (5900, 5901, 5902, etc.). Keep the destination port at 5900. If you are using a SecureEdge Pro with firmware 5.3.1 or higher, make sure to enter a source port that is not exposed by a Docker container. Port forwards do not work if the source port is also exposed by a Docker container. This is a known issue.
   Destination IP address	The IP address to which the traffic needs to be forwarded.
   Destination port	The port number to which the traffic needs to be forwarded. Often the same as the source port.

6. Repeat the previous steps for every device you need to access.

You have now made the changes in the IXON Cloud, but these are not yet active in your device. You will need to push your changes to your device for them to take effect.

7. Click on Push config to device in the top right corner.

Local web interface

To add port forwarding via the local web interface, select your edge gateway model: