Forward rules
A forward rule = on a given node, forward traffic from an ingress port to a target address:port.
Creating a rule
Section titled “Creating a rule”| Field | Description |
|---|---|
| Node | Which node the rule takes effect on |
| Ingress port | The port the node listens on externally |
| Target address | Upstream IP / domain to forward to |
| Target port | Upstream port |
| Protocol | TCP / UDP (both at once allowed) |
| Rate limit | Optional, kernel-level shaping via tc HTB |
| Real-IP passthrough | Optional PROXY protocol; passes the client’s real IP to the upstream |
After saving, the rule enters the config delivery queue and is applied by FF1 Core.
Same-position passthrough for port ranges and lists
Section titled “Same-position passthrough for port ranges and lists”The ingress supports mixed ranges and lists, with ingress and egress ports mapped one-to-one (same position, same number), like RouterOS:
50-60,80,90-200The single rule above passes 50-60, 80, and 90-200 through to the target on their original port numbers, with no per-port mapping.
License quota
Section titled “License quota”The total number of forward rules is capped by the license forward_count. At the limit, upgrade your plan or delete rules.
Next steps
Section titled “Next steps”- Tunnels & tunnel chaining: chain multiple nodes into a forwarding path
- Config delivery queue