I currently have a small network which contains an FTP server that I'd like to be able to access from the Internet at home.

This network has a firewall with 2 interfaces - - Facing the internal network & going to my router at I need to be able to forward ports from the router's subnet, through the firewall on to my internal subnet and to the FTP server.

I'm not sure if static routes are the most ideal way to achieve this, or exactly how it should be set. With static routes am I correct in the assumption I'd need a route going from the router to the firewall with its gateway set as, with destination IP, and setup port forwarding on the firewall to the FTP server?

Please advise, I also attach a simplified diagram.

Network Diagram

Routes view from Router

  • I don't see any netmasks; are those and
    – vhu
    Commented Jun 19, 2014 at 11:27
  • Yes they're both /24.
    – Richard
    Commented Jun 19, 2014 at 11:28
  • ZyXEL screenshot is barely readable but it looks like you should have as destination IP and as subnet mask.
    – vhu
    Commented Jun 19, 2014 at 11:50
  • If you click to view the image, you should be able to zoom in. The netmask was autofilled by the router.
    – Richard
    Commented Jun 19, 2014 at 11:50
  • When entering only as the destination the netmask changes to, so I'm not exactly sure what that would achieve.
    – Richard
    Commented Jun 19, 2014 at 11:58

1 Answer 1


Static routes are just fine. In this case your default gateway should always point towards internet:

  • FTP server should have default gateway
  • Firewall's default route ( should have next hop

Firewall shouldn't need any other routes. and are already connected so they should be in the routing table already.

Your router ( should have static route for via

Port forwarding must be done at least on a device with public IP address - router in your case. In this case you don't need to perform NAT nor port forwarding on the firewall it'll just run the firewall rules. Port forwarding on the router should set as new destination address.

You could do port forwarding on both firewall and router but I that's probably counter productive. You cannot perform port forwarding and NAT on firewall only as it isn't reachable from the Internet due to private IP addresses.

  • The FTP Server already has the default gateway set like you suggest, and the firewall's default route is as you specified and the routing table does indeed contain the route for
    – Richard
    Commented Jun 19, 2014 at 11:45
  • With the information provided would you say the configuration in the newly added picture to my original post is correct?
    – Richard
    Commented Jun 19, 2014 at 11:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.