Expose a local service on the Internet from Ubuntu: Complete guide to port forwarding

Published on 28 May 2025

Target audience : intermediate

  • Assumed prerequisites : basic knowledge of Ubuntu, the terminal, basic networking concepts

  • Technical concepts : NAT, port forwarding, firewall, reverse proxy

  • System commands: utilization du terminal, configuration réseau ???

Wait correct translation: "utilisation du terminal" → "use of the terminal", "configuration réseau" → "network configuration". Ensure commas placement: after colon space then translation phrase separated by comma.

So final: "System commands: use of the terminal, network configuration".

Make sure no extra whitespace at start/end.

Proceed.

</think>

System commands: use of the terminal, network configuration

  • Advanced sections : monitoring, security, cloud alternatives

The problem: NAT and private addresses

Problematic: You are developing a web application on your Ubuntu machine and want to make it accessible from outside your home network? You’re in the right place! In this article, we will see how to expose a local service (for example on port 8080) to the Internet by configuring port forwarding on your internet box.

By default, your internet box uses NAT (Network Address Translation) to share a single public IP address among all devices on your home network. Your local machines use private IP addresses (192.168.x.x, 10.x.x.x, etc.) that are not routable on the Internet.

When you launch a service on your Ubuntu machine (for example a web server on port 8080), it is only accessible from your local network. To make it accessible from the Internet, we need to configure a port forwarding.

Step 1: Identify your public IP address

First of all, let’s retrieve your Internet connection’s public IP address:

# Plusieurs méthodes au choix
curl ifconfig.me
curl ipecho.net/plain
wget -qO- http://ipecho.net/plain

# Ou encore
curl -s checkip.amazonaws.com

This IP address is the one that Internet users will use to access your service.

Step 2: Know the local IP address of your Ubuntu machine

Your Ubuntu machine has a private IP address on your local network. To find it:

# Afficher toutes les interfaces réseau
ip addr show

# Ou plus spécifiquement pour l'interface principale
ip route get 1.1.1.1 | awk '{print $7; exit}'

# Alternative avec hostname
hostname -I | awk '{print $1}'

Note this address (for example`192.168.1.100`), we will need it for the configuration.

Step 3: Set up port forwarding on your box

Configuration varies depending on the model of your box, but the principle remains the same:

Access to the administration interface

Open your browser and go to the web interface of your box:

  • Freebox:`192.168.1.1` ou mafreebox.freebox.fr

  • Livebox Orange:`192.168.1.1`

  • SFR Box:`192.168.1.1`

  • Bbox Bouygues:`192.168.1.254`

Redirect configuration

Look for the section dedicated to port forwarding (names vary):

  • Port forwarding

  • NAT/PAT

  • Port Forwarding

  • game servers

Create a new rule with these settings:

Field Value

Name/Description

Ubuntu Web Service" (or other explicit name)

External port (or public port)

8080

Internal IP address

The IP of your Ubuntu machine (ex: 192.168.1.100)

Internal port (or private port)

8080

Protocol

TCP

State

Enabled

Step 4: Setting up the service on Ubuntu

Make sure your service listens on all interfaces, not only on localhost:

# ✅ Correct : écoute sur toutes les interfaces
python3 -m http.server 8080 --bind 0.0.0.0

# ❌ Incorrect : écoute seulement en local
python3 -m http.server 8080 --bind 127.0.0.1

To check that your service is listening correctly:

# Vérifier les ports en écoute
sudo netstat -tlnp | grep :8080
# ou avec ss (plus moderne)
sudo ss -tlnp | grep :8080

You should see something like`0.0.0.0:8080`and not`127.0.0.1:8080`.

Step 5: Configuring Ubuntu Firewall

Ubuntu uses UFW (Uncomplicated Firewall) by default. Check its status and allow the port if necessary:

# Vérifier le statut du pare-feu
sudo ufw status

# Si le pare-feu est actif, autoriser le port 8080
sudo ufw allow 8080/tcp

# Ou plus spécifiquement pour un service web
sudo ufw allow 'Apache'  # si vous utilisez Apache
sudo ufw allow 'Nginx Full'  # si vous utilisez Nginx

Step 6: Testing and validation

Test from the local network

First, test access from another machine on your local network:

# Remplacez par l'IP locale de votre machine Ubuntu
curl http://192.168.1.100:8080

Test from outside

Now test from the Internet using your public IP:

# Remplacez par votre IP publique
curl http://VOTRE_IP_PUBLIQUE:8080

You can also use online tools such as:

Best practices and security

Basic security

# Configurer fail2ban pour protéger contre les attaques par force brute
sudo apt update && sudo apt install fail2ban

# Limiter l'accès avec UFW (exemple : autoriser seulement certaines IP)
sudo ufw allow from 203.0.113.0/24 to any port 8080

Monitoring of connections

# Surveiller les connexions en temps réel
sudo netstat -an | grep :8080

# Logs des connexions (selon votre application)
sudo tail -f /var/log/nginx/access.log  # pour Nginx
sudo journalctl -f -u your-service      # pour un service systemd

Use of a reverse proxy

For better security and flexibility, consider using a reverse proxy such as Nginx:

server {
    listen 80;
    server_name votre-domaine.com;

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Alternatives to port forwarding

Cloud solutions

  • ngrok: temporary secure tunnel

  • Cloudflare Tunnelfree and secure solution

  • serveo.net: simple SSH tunnel

# Exemple avec ngrok
ngrok http 8080

# Exemple avec serveo
ssh -R 80:localhost:8080 serveo.net

VPS and reverse proxy

For professional use, consider using a VPS with a reverse proxy pointing to your local infrastructure via VPN.

Troubleshooting

Common problems

Problem solution

Service inaccessible from outside

Check the port forwarding configuration and ensure the service is listening on 0.0.0.0

Connection refused

The service is not started or is listening only on 127.0.0.1

Connection timeout

Firewall problem (box or Ubuntu) or misconfigured port forwarding

Public IP changes regularly

Configure a dynamic DNS (DynDNS, No-IP, etc.)

Network debugging

# Tester la connectivité locale
telnet localhost 8080

# Tester depuis une autre machine du réseau
telnet 192.168.1.100 8080

# Vérifier les routes réseau
ip route show

# Analyser le trafic réseau
sudo tcpdump -i any port 8080

Conclusion

Exposing a local service on the Internet requires careful configuration of port forwarding, security, and monitoring. While this approach is perfect for development or personal projects, consider more robust alternatives (VPS, CDN, cloud services) for production use.

The important thing is to always keep security in mind: use strong passwords, regularly update your system, and monitor access to your exposed services.

Feel free to share your experiences and questions in the comments!

Related articles

HyperFrames-Gradle: Transform AsciiDoc into MP4 Video
31 May 2026
Audit of my LLM consumption: SQLite, OpenCode, Ollama Cloud, and Why My Pro Subscription Shakes the Global Market
18 May 2026
The 'Independent Plugin + Consumer Root' Architecture: Why My Gradle Builds Duplicate
14 May 2026
The Knowledge Graph as a recommendation engine: how I killed the chronological 'related articles'
12 May 2026