Expose a VM to the internet

Before you begin

Check these first — each one is something the two rules depend on.

• You need permission to view firewalls and to create firewall and DNAT rules. If you are not sure, ask your administrator.
• A firewall exists with both an external (internet-facing) interface and an internal interface on the VM's network.
• The target VM is running and has a known internal IP address.

A DNAT rule on its own will not make the VM reachable — it only rewrites the address. Traffic is still blocked until you add the allow rule in the second step.

Add a DNAT rule

DNAT translates the inbound external destination to the VM's internal address.

1. Open Networking → Firewalls, open your firewall, then open the DNAT tab.
2. Select Create DNAT Rule.
3. Set the rank, the inbound (external) interface, and the protocol: TCP, UDP, TCP/UDP, ICMP, or Any.
4. Enter the original destination IP or CIDR (the external address) and the translated destination IP or CIDR (the VM's internal address).
5. For TCP or UDP protocols, enter the original port and the translated port.
6. Save.

Expected result: the DNAT rule is queued and appears in the Task Manager while it is applied.

Add an allow rule for the inbound traffic

This is the step that actually admits the traffic the DNAT rule redirected.

1. Open the Rules tab on the same firewall.
2. Select Create.
3. Enter a rule name, set the rank (1-9998; lower rank = higher priority), and toggle Enabled.
4. Choose the inbound (external) interface and set the action to Allow.
5. Choose the protocol matching the DNAT rule.
6. Set the source to the permitted origin IP or CIDR (or Any) and the destination to the VM's internal IP; for TCP or UDP, add the destination port.
7. Save.

Expected result: the rule set is queued and applied in rank order, admitting the translated inbound traffic to the VM.

Check it is working

1. Open the Task Manager (top bar) and confirm both the DNAT and rule tasks have completed.
2. From a computer outside your network, connect to the external IP and port — the connection should reach the VM.
3. If it does not, check the rank order on the Rules tab and confirm the DNAT translated IP and port match the VM.

Next steps

• Create your first firewall — build the firewall and interfaces this guide depends on (click here)
• Firewalls — full reference for rules, SNAT, DNAT, static routes, OSPF, DHCP, and logs (click here)