Firewall, port forwarding and secure remote access

Block unsolicited inbound traffic by default

A stateful firewall normally allows replies to outbound sessions and blocks unsolicited inbound sessions. Do not expose router administration, SSH or NAS administration directly to the public Internet.

Preferred order

1. VPN: Authenticate into the home network with a protocol such as WireGuard.
2. Vendor relay: Use only maintained services with MFA and scoped accounts.
3. Port forwarding: Use only when unavoidable and limit it to one service and host.

Review these features

• Automatic UPnP port mapping
• Router administration from WAN
• Unused WPS
• Default administrator credentials
• Unsupported or stale firmware

If forwarding is unavoidable

Patch the service, require strong authentication and MFA, log access and rate-limit failures. Restrict source IPs where possible. Never expose a NAS management port or SMB 445/TCP directly to the Internet.