JPPS

Opening Other Ports

Updated Oct 27, 2026

Everything covered so far has been about regular websites — things a web browser talks to over HTTPS. But some services aren't websites at all: a remote-desktop tool, a game server, a VPN, a backup service. These still need a "door" opened in the firewall so they can be reached, but RustProxy can't route them by domain name the way it does websites, because they don't speak the web's language.

That's what Network, then Port rules, is for.

What a "port" is

Think of your server as a building with many numbered doors (ports). A regular website normally uses door 443 (HTTPS) or 80 (HTTP). Other services use their own specific door numbers — for example, a popular remote-access tool might use door 21115.

By default, every door is locked except the handful RustProxy needs for itself (SSH so you can manage the server, and the web ports). Adding a port rule is how you deliberately unlock a specific door for a specific service.

Adding a port rule

  1. Go to Network, then Port rules, and click New rule.
  2. Fill in:
    • Bind IPv4 / Bind IPv6: which network address to open the door on (usually "All interfaces")
    • From port / To port — the door number(s) to open. A single service is usually one number in both fields; some services need a range.
    • Protocol — almost always tcp; a small number of services use udp instead (check that service's own documentation if unsure)
    • Passthrough target (optional) — if filled in, RustProxy also forwards traffic through to another address, e.g. 127.0.0.1:21115, the same way it does for websites. If left blank, this just unlocks the door for a service that's already running directly on this server and listening for its own connections — RustProxy isn't in the middle of that traffic at all, only the firewall part applies.
    • Description (optional) — a name to remind yourself what this rule is for, e.g. "remote desktop tool"
  3. Click Add rule. RustProxy shows the firewall change first (green lines are added); click Add rule again to confirm.

Restricting who can use a port rule

Just like websites can have an allowed-networks restriction (see Protecting a Site), a port rule can too — select an IP-allow ACL in the rule's form. Only visitors from that list of networks can reach this port at all; everyone else is blocked at the firewall itself, before the connection even gets anywhere.

There's an important difference from how websites handle this: a port rule has no login-page option, only the allowed-networks option. That's because a port rule isn't something a web browser is involved in — there's no page to show a login form on, so there's nothing to "fall back" to the way a website can fall back to a login page. If the visitor's network doesn't match, the connection is simply refused.

Letting your phone in from anywhere

If you use the RustProxy Mobile Pass app, an IP-allow list can also let your phone in from whatever network it's on (see Protecting a Site, "Mobile passes"). For port rules, that needs one more checkbox on the list: Also open port rules and hosted ports. With it on, a port rule that uses the list also lets in the phone's current address while the app is switched on. When the app is switched off, the phone changes networks, or it stops checking in for 90 seconds, the door closes again, and any connection it had open (an SSH session, say) is cut.

Only tick this for services that still ask for their own password or key. On cellular, many people share one public address, and a port rule has no RustProxy sign-in page in front of it.

Removing a port rule

Every rule in the table has a Delete button. RustProxy shows the firewall change, and once you confirm, that door is locked again immediately.

When you don't need this page at all

If everything you're running is a regular website, you'll likely never need this page — Adding a Website covers that entirely on its own. This page only matters for services outside the web (remote access tools, game servers, and similar).