Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To send requests arriving on TCP port 8080 to a web service on port 80 on the same Linux host, use a NAT redirect: nftables redirect to :80 in a nat prerouting chain, or firewalld’s --add-forward-port. If port 80 is on a different machine, use DNAT with a destination address, enable packet forwarding, and allow the routed return path. A rule that merely opens port 80 does not translate another port.
Decide which forwarding case you have
Port forwarding is a destination-NAT operation. The correct rule depends first on where the service listening on port 80 resides.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Situation | Correct operation | Address translation | Additional requirement |
|---|---|---|---|
| Port 8080 and the service on port 80 are on this Linux host | Local redirect | Destination port changes to 80; destination address remains the local host | The service must listen on port 80 and the rule must match the interface and protocol carrying the request |
| Port 8080 is on this Linux host, but the service on port 80 is on another host | DNAT (destination NAT) | Destination address changes to the remote host and the port changes to 80 | IP forwarding, forwarding-policy permission, and a working return route |
| You only need to permit clients to reach an existing service on port 80 | Firewall allow rule | No translation | The application already listens on port 80 |
The nftables manual describes redirect as “a special form of dnat which always translates the destination address to the local host.” That is why redirect is appropriate for changing the port of traffic that should stay on this machine. DNAT is the routed alternative when the destination has its own IP address.
Check the service and traffic before changing NAT
Perform these checks from a root shell or prefix commands with sudo. They prevent a NAT rule from hiding an application or protocol problem.
#1 Best Overall
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
- Confirm that an application is listening on TCP port 80:
sudo ss -ltnp | grep ':80'. - Record the interface and address on which clients arrive. A rule restricted to
ens3, for example, will not match traffic entering through another interface. - Confirm that clients really use TCP. The examples below are TCP rules; a UDP service needs a UDP rule, and the application must support that protocol.
- Identify which component owns the firewall: a direct nftables ruleset, firewalld, or another service. Use one authoritative manager for the NAT table where possible.
- Write down whether the change must survive a reboot or a firewalld restart. A runtime-only rule is useful for testing but is not a permanent configuration.
A service bound only to loopback (for example, an address in the 127.0.0.0/8 range) may not be reachable through the external address in the way you expect. Verify the listening address in the ss output and test through the same address and network path that real clients use.
Forward port 8080 to local port 80 with nftables
Use a redirect when both ports are served by this Linux host. The following IPv4 ruleset creates a NAT table and a prerouting chain, then changes incoming TCP traffic on port 8080 to local port 80.
table ip nat {
chain prerouting {
type nat hook prerouting priority -100;
tcp dport 8080 redirect to :80
}
}The nat table is used for address and port translation. The prerouting chain runs before the normal input decision, and priority -100 is the conventional priority for a NAT prerouting chain. The rule matches TCP destination port 8080 and redirects it to port 80 on the local host.
Load and inspect the rule
Place the rules in the nftables configuration used by your distribution, or load them with your distribution’s nftables service, then inspect the active configuration:
sudo nft list rulesetThe output should contain the ip nat table, its prerouting chain, and the redirect rule. If the table or chain already exists, add only the missing rule rather than creating duplicate chains. A duplicate redirect can make later troubleshooting confusing even though nftables may accept equivalent rules.
Restrict the rule to an interface when necessary
If port 8080 should be translated only for traffic arriving on one interface, add an input-interface match:
table ip nat {
chain prerouting {
type nat hook prerouting priority -100;
iifname "ens3" tcp dport 8080 redirect to :80
}
}Replace ens3 with the interface that actually receives the client traffic. Leaving out the interface match applies the rule to matching traffic entering any interface handled by that IPv4 prerouting chain, including interfaces you may not intend to expose.
Rank #2
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
Test the local redirect
- Start or verify the web service on port 80.
- From a client, connect to the Linux host’s address on port 8080. For an HTTP service, request the URL with the explicit port, such as
http://server-address:8080/. - Run
sudo nft list rulesetagain and check whether the rule counters increase, if counters are displayed by your nftables version. - If the request fails, test the service directly on port 80 from an allowed network. A failure there is an application, bind-address, or ordinary firewall problem rather than a translation problem.
Remove or change a redirect
Do not remove an entire NAT table if it contains unrelated rules. List the rule with handles, identify the redirect’s handle, and delete that rule using the handle supported by your nftables version. Then verify the resulting ruleset. Removing the rule does not stop the application listening on port 80; it only stops translating new traffic that arrives on port 8080.
Compatibility note
Project documentation records nftables redirect availability beginning with Linux kernel 3.19. On a supported modern distribution, the practical checks are whether nftables is installed, whether the running kernel supports the expression, and whether another firewall manager is replacing the rules after they are loaded.
Use nftables DNAT when port 80 is on another host
For a remote web server, redirect is the wrong operation because it always targets the local machine. Use DNAT and specify the remote destination address and port. This representative rule accepts TCP traffic arriving on ens3 at port 8080 and changes its destination to 192.0.2.14:80:
table ip nat {
chain prerouting {
type nat hook prerouting priority -100;
iifname "ens3" tcp dport 8080 dnat to 192.0.2.14:80
}
}192.0.2.14 is an example address; substitute the actual reachable IPv4 address of the backend. The address must be routable from the forwarding machine, and the backend must listen on port 80 at that address.
Enable and permit routing
DNAT alone does not make a routed connection work. The Linux machine must be configured to forward packets, and its forwarding policy must permit the traffic from the incoming interface or zone to the outgoing interface or zone. The backend must also have a return route that sends replies back through the translating machine, or replies can bypass the translator and the client will never complete the connection.
When a firewall filters forwarded traffic, allow the new connection in the forward path and allow the related return traffic. NAT changes the destination; it does not override a deny policy, fix an incorrect route, or open port 80 on the backend.
Choose DNAT versus redirect by destination
- Use
redirect to :80when the application is local and the destination address should remain this host. - Use
dnat to address:80when the application is on another host. - Do not add
toaddror a DNAT destination merely to open a local service; doing so changes the routing problem you must solve.
Forward a port with firewalld
firewalld exposes port forwarding through --add-forward-port. The documented option adds an IPv4 forward port and accepts TCP, UDP, SCTP, or DCCP. The examples here use TCP because ordinary HTTP uses TCP.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #3
- NIGHTHAWK WIFI 6 ROUTER FOR YOUR WHOLE HOME: Delivers fast, reliable WiFi across every room of your apartment or small home for streaming, gaming, video calls, and smart home devices, all running at the same time without slowing each other down.
- WORKS WITH YOUR EXISTING INTERNET SERVICE: Pairs with your existing modem or gateway via ethernet. Compatible with most cable, fiber, DSL, and satellite providers. Some gateways and modem router combos may require bridge mode. No coax needed.
- SET UP AND MANAGE YOUR NETWORK WITH THE NIGHTHAWK APP: Download the free Nighthawk app on iOS or Android for guided setup. Manage WiFi, run speed tests, pause devices, and set up guest networks from anywhere. Active internet required.
- READY FOR THE DEVICES YOU ALREADY OWN: Your phones, laptops, and TVs work right out of the box. WiFi 6 delivers speeds up to 1.8 Gbps across 2.4 GHz and 5 GHz bands. Backward compatible with WiFi 5 and earlier.
- COVERAGE IN EVERY ROOM: Covers up to 1,500 sq. ft. for up to 20 connected devices. Walls, floors, and interference can reduce range. Larger or multi-story homes may benefit from a NETGEAR Orbi mesh WiFi system.
Local service: 8080 to port 80 on this host
sudo firewall-cmd --zone=public --add-forward-port=port=8080:proto=tcp:toport=80Replace public with the zone assigned to the interface receiving the client traffic. This is a local port translation: firewalld sends matching traffic to port 80 on the same host. The application still has to be listening on port 80.
Remote service: 8080 to another IPv4 host on port 80
sudo firewall-cmd --zone=public --add-forward-port=port=8080:proto=tcp:toport=80:toaddr=192.0.2.14Adding toaddr supplies the destination address for the forwarded connection. The firewalld manual notes that IP forwarding is implicitly enabled when toaddr is specified, but the connection still needs an appropriate forwarding policy and a valid return path. Check the backend’s route and any firewall on the backend itself.
Make a firewalld rule persistent
A command without --permanent changes the runtime configuration. Runtime changes disappear after a reboot or a firewalld restart. Add the permanent rule, then reload:
sudo firewall-cmd --permanent --zone=public --add-forward-port=port=8080:proto=tcp:toport=80
sudo firewall-cmd --reloadFor a remote destination, include :toaddr=192.0.2.14 in the permanent command as well. After reloading, verify that the rule is present in the active configuration rather than assuming that a successful command changed both runtime and permanent state.
Inspect and remove firewalld forward ports
List the forward ports in the zone receiving traffic:
sudo firewall-cmd --zone=public --list-forward-portsUse the matching --remove-forward-port syntax to undo a runtime rule. If the unwanted rule is also permanent, remove it with --permanent and reload again. Keep the port, protocol, destination port, and destination address identical to the rule you intend to remove.
Do not confuse an allow rule with a forward rule
sudo firewall-cmd --zone=public --add-port=80/tcpor:
sudo firewall-cmd --zone=public --add-service=httpThese commands permit traffic to an application that already listens on port 80. They do not make requests sent to port 8080 arrive at port 80. For translation, use --add-forward-port.
Rank #4
- 𝐅𝐮𝐭𝐮𝐫𝐞-𝐏𝐫𝐨𝐨𝐟 𝐘𝐨𝐮𝐫 𝐇𝐨𝐦𝐞 𝐖𝐢𝐭𝐡 𝐖𝐢-𝐅𝐢 𝟕: Powered by Wi-Fi 7 technology, enjoy faster speeds with Multi-Link Operation, increased reliability with Multi-RUs, and more data capacity with 4K-QAM, delivering enhanced performance for all your devices.
- 𝐁𝐄𝟑𝟔𝟎𝟎 𝐃𝐮𝐚𝐥-𝐁𝐚𝐧𝐝 𝐖𝐢-𝐅𝐢 𝟕 𝐑𝐨𝐮𝐭𝐞𝐫: Delivers up to 2882 Mbps (5 GHz), and 688 Mbps (2.4 GHz) speeds for 4K/8K streaming, AR/VR gaming & more. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance, and obstacles like walls.
- 𝐔𝐧𝐥𝐞𝐚𝐬𝐡 𝐌𝐮𝐥𝐭𝐢-𝐆𝐢𝐠 𝐒𝐩𝐞𝐞𝐝𝐬 𝐰𝐢𝐭𝐡 𝐃𝐮𝐚𝐥 𝟐.𝟓 𝐆𝐛𝐩𝐬 𝐏𝐨𝐫𝐭𝐬 𝐚𝐧𝐝 𝟑×𝟏𝐆𝐛𝐩𝐬 𝐋𝐀𝐍 𝐏𝐨𝐫𝐭𝐬: Maximize Gigabitplus internet with one 2.5G WAN/LAN port, one 2.5 Gbps LAN port, plus three additional 1 Gbps LAN ports. Break the 1G barrier for seamless, high-speed connectivity from the internet to multiple LAN devices for enhanced performance.
- 𝐍𝐞𝐱𝐭-𝐆𝐞𝐧 𝟐.𝟎 𝐆𝐇𝐳 𝐐𝐮𝐚𝐝-𝐂𝐨𝐫𝐞 𝐏𝐫𝐨𝐜𝐞𝐬𝐬𝐨𝐫: Experience power and precision with a state-of-the-art processor that effortlessly manages high throughput. Eliminate lag and enjoy fast connections with minimal latency, even during heavy data transmissions.
- 𝐂𝐨𝐯𝐞𝐫𝐚𝐠𝐞 𝐟𝐨𝐫 𝐄𝐯𝐞𝐫𝐲 𝐂𝐨𝐫𝐧𝐞𝐫 - Covers up to 2,000 sq. ft. for up to 60 devices at a time. 4 internal antennas and beamforming technology focus Wi-Fi signals toward hard-to-reach areas. Seamlessly connect phones, TVs, and gaming consoles.
IPv4 and IPv6 considerations
The nftables examples use an ip table, so they match IPv4. An IPv6 deployment needs an IPv6-aware ruleset and addresses; do not assume that an IPv4 forward automatically covers IPv6 traffic.
Recommended Free Tools
firewalld’s --add-forward-port option is documented for IPv4. For IPv6 forward ports, use firewalld’s rich language and write an IPv6-appropriate rule. The listener, destination address, routing policy, and firewall rules must all be valid for the same address family. A client that prefers IPv6 can therefore bypass an IPv4-only translation rule or fail independently even while IPv4 works.
Understand where a forwarded packet is processed
An incoming packet first reaches the interface and the NAT prerouting path. A local redirect changes the destination port and keeps the destination on the local host, after which the packet proceeds toward the local service. DNAT changes the destination address and port, after which the kernel routes the packet out toward the backend and evaluates forwarding policy. The reply must return through the translating host so the NAT state can rewrite it back to the client’s original connection.
This distinction explains several common surprises:
- Opening port 80 does not alter packets addressed to 8080.
- A local redirect cannot send traffic to a different machine.
- A DNAT rule can match correctly while forwarding policy or the return route still blocks the connection.
- Traffic generated on the forwarding host itself may not traverse the same prerouting path as traffic arriving from an external client.
Troubleshoot in a fixed order
Change one variable at a time and test from the network where the real clients reside.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches1. Verify the target listener
sudo ss -ltnp | grep ':80'No matching listener means the translation has nothing to deliver to. Check the service configuration, startup status, and bind address before editing NAT.
2. Confirm protocol, port, interface, and zone
A TCP rule does not match UDP. A rule restricted to ens3 does not match traffic entering on another interface. A firewalld rule in the wrong zone is effectively absent for the client’s interface. Confirm the client’s destination port is exactly 8080 and that no upstream device is changing it first.
Best Value
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
3. Inspect the active configuration
sudo nft list ruleset
sudo firewall-cmd --zone=public --list-forward-portsUse the command corresponding to the manager that owns the rule. If the nftables ruleset does not contain the rule, it was not loaded or was overwritten. If firewalld does not list the forward port, check that you selected the correct zone and that a reload did not discard a runtime-only change.
4. Separate local-redirect faults from routed-DNAT faults
For a local redirect, test the service directly at port 80 and then through port 8080 from an external client. For DNAT, test reachability from the forwarding host to the backend’s port 80, then test the complete client-to-backend path. This identifies whether the failure is at the application, translation, route, or forwarding policy.
5. Check forwarding and the return path for DNAT
Verify that packet forwarding is enabled, the forwarding policy permits the new connection, and the backend sends replies back through the NAT machine. Firewalld’s stateful filtering allows the return path for established connections when the forward policy permits the connection, but an incorrect route or a separate backend firewall can still prevent replies.
6. Look for another manager overwriting the rule
Container networking, UFW, firewalld, distribution services, and direct nftables commands can all modify filtering or NAT. If a rule appears and later vanishes, identify which service reloads the tables and make that service the owner of the configuration. Avoid maintaining competing definitions for the same NAT chain.
7. Test hairpin and loopback paths separately
A request made from the forwarding host itself, or a client on the same local network that uses the public address, can traverse different hooks and policies from a request arriving on the external interface. Test from the actual client network first. If external clients work but local clients fail, investigate hairpin or loopback handling rather than rewriting a working external rule.
Persistence, rollback, and operational safety
- Keep a copy of the known-good rules before editing a production firewall.
- Apply changes from a console or a session with a recovery path; a syntax or policy error can cut off remote administration.
- For firewalld, deliberately choose runtime-only testing or a permanent rule followed by
--reload. - For direct nftables, use the distribution’s persistent nftables service and configuration location rather than assuming a manually loaded ruleset survives reboot.
- Document the listening application, source interface, protocol, external port, translated destination, and rollback command.
- Expose only the interfaces and ports required by the design. An unrestricted 8080 rule can publish an administrative or unintended service if the listener changes later.
After a successful test, verify both paths: a legitimate request reaches the intended service, and an unrelated port or interface is not accidentally translated. Recheck after reboot or firewall reload if persistence matters.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Worked decision examples
Web server on the same host
A web server listens on port 80, while clients are configured to use port 8080. Choose nftables redirect or firewalld’s local forward-port command. Do not add a remote destination address. Confirm the incoming interface and make the chosen configuration persistent.
Dedicated backend server
A gateway receives connections on 8080 and the web server at 192.0.2.14 listens on 80. Choose nftables DNAT or firewalld forward-port with toaddr. Confirm forwarding policy, the gateway’s route to the backend, and the backend’s return route through the gateway.
Only an access problem on port 80
The service already listens on port 80 and clients already use port 80, but a firewall blocks them. Add an allow rule for the appropriate zone or service. Port forwarding would solve a different problem and adds unnecessary translation.
Key distinctions to keep
- Redirect: local destination, port translated on this host.
- DNAT: destination address and usually port translated toward another host.
- Allow rule: traffic permitted without changing its destination.
- Runtime configuration: active now but may disappear on restart.
- Permanent configuration: retained by firewalld after reload or reboot when saved correctly.
Start with the listener check, select redirect or DNAT based on the destination, use the manager that owns your firewall, and validate the complete return path whenever another host is involved.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
