Exposing a local service on the Internet from Ubuntu: Complete guide to port forwarding

Published on 28 May 2025

Target audience: Intermediate

  • Assumed prerequisites: basic knowledge of Ubuntu, the terminal, basic networking concepts

  • Technical concepts: NAT, port forwarding, firewall, reverse proxy

  • System commands: terminal usage, network configuration

  • Advanced sections: monitoring, security, cloud alternatives

The problem: NAT and private addresses

Problem statement: Are you developing a web application on your Ubuntu machine and want to make it accessible from outside your home network? You’ve come to the right place! In this article, we will see how to expose a local service (for example on port 8080) to the Internet by configuring port forwarding on your internet box.

By default, your internet box uses NAT (Network Address Translation) to share a single public IP address among all devices on your home network. Your local machines use private IP addresses (192.168.x.x, 10.x.x.x, etc.) which are not routable on the Internet.

When you launch a service on your Ubuntu machine (for example a web server on port 8080), it is only accessible from your local network. To make it accessible from the Internet, we must configure a port redirection.

Step 1: Identify your public IP address

First, let’s retrieve the public IP address of your Internet connection:

# Plusieurs méthodes au choix
curl ifconfig.me
curl ipecho.net/plain
wget -qO- http://ipecho.net/plain

# Ou encore
curl -s checkip.amazonaws.com

This IP address is the one that internet users will use to access your service.

Step 2: Know the local IP address of your Ubuntu machine

Your Ubuntu machine has a private IP address on your local network. To find it:

# Afficher toutes les interfaces réseau
ip addr show

# Ou plus spécifiquement pour l'interface principale
ip route get 1.1.1.1 | awk '{print $7; exit}'

# Alternative avec hostname
hostname -I | awk '{print $1}'

Note this address (for example`192.168.1.100`), we will need it for the configuration.

Step 3: Configure port forwarding on your box

Configuration varies depending on your box model, but the principle remains the same:

Access to the administration interface

Open your browser and go to the web interface of your box:

  • Freebox:`192.168.1.1` ou mafreebox.freebox.fr

  • Livebox Orange:`192.168.1.1`

  • SFR Box:`192.168.1.1`

  • Bbox Bouygues:`192.168.1.254`

Redirection configuration

Look for the section dedicated to port forwarding (names vary):

  • "Port redirection"

  • "NAT/PAT"

  • "Port Forwarding"

  • "Game servers"

Create a new rule with these parameters:

Field Value

Name/Description

"Ubuntu Web Service" (or another explicit name)

External port (or public port)

8080

Internal IP address

Your Ubuntu machine’s IP (e.g.: 192.168.1.100)

Internal port (or private port)

8080

Protocol

TCP

Status

Enabled

Step 4: Service configuration on Ubuntu

Ensure that your service listens on all interfaces, not just on localhost:

# ✅ Correct : écoute sur toutes les interfaces
python3 -m http.server 8080 --bind 0.0.0.0

# ❌ Incorrect : écoute seulement en local
python3 -m http.server 8080 --bind 127.0.0.1

To verify that your service is listening correctly:

# Vérifier les ports en écoute
sudo netstat -tlnp | grep :8080
# ou avec ss (plus moderne)
sudo ss -tlnp | grep :8080

You should see something like`0.0.0.0:8080`and not`127.0.0.1:8080`.

Step 5: Ubuntu firewall configuration

Ubuntu uses UFW (Uncomplicated Firewall) by default. Check its status and allow the port if necessary:

# Vérifier le statut du pare-feu
sudo ufw status

# Si le pare-feu est actif, autoriser le port 8080
sudo ufw allow 8080/tcp

# Ou plus spécifiquement pour un service web
sudo ufw allow 'Apache'  # si vous utilisez Apache
sudo ufw allow 'Nginx Full'  # si vous utilisez Nginx

Step 6: Test and validation

Test from the local network

First, test the access from another machine on your local network:

# Remplacez par l'IP locale de votre machine Ubuntu
curl http://192.168.1.100:8080

Test from the outside

Now, test from the Internet using your public IP:

# Remplacez par votre IP publique
curl http://VOTRE_IP_PUBLIQUE:8080

You can also use online tools such as:

Best practices and security

Basic securing

# Configurer fail2ban pour protéger contre les attaques par force brute
sudo apt update && sudo apt install fail2ban

# Limiter l'accès avec UFW (exemple : autoriser seulement certaines IP)
sudo ufw allow from 203.0.113.0/24 to any port 8080

Connection monitoring

# Surveiller les connexions en temps réel
sudo netstat -an | grep :8080

# Logs des connexions (selon votre application)
sudo tail -f /var/log/nginx/access.log  # pour Nginx
sudo journalctl -f -u your-service      # pour un service systemd

Using a reverse proxy

For better security and flexibility, consider using a reverse proxy like Nginx:

server {
    listen 80;
    server_name votre-domaine.com;

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

Alternatives to port forwarding

Cloud solutions

  • ngrok: temporary secure tunnel

  • Cloudflare Tunnel: free and secure solution

  • serveo.net: simple SSH tunnel

# Exemple avec ngrok
ngrok http 8080

# Exemple avec serveo
ssh -R 80:localhost:8080 serveo.net

VPS and reverse proxy

For professional use, consider using a VPS with a reverse proxy pointing to your local infrastructure via VPN.

Troubleshooting

Common problems

Problem Solution

Service inaccessible from the outside

Verify the port forwarding configuration and that the service listens on 0.0.0.0

"Connection refused"

The service is not started or is listening on 127.0.0.1 only

"Connection timeout"

Firewall problem (box or Ubuntu) or misconfigured port forwarding

Public IP changes regularly

Configure a dynamic DNS (DynDNS, No-IP, etc.)

Network debug

# Tester la connectivité locale
telnet localhost 8080

# Tester depuis une autre machine du réseau
telnet 192.168.1.100 8080

# Vérifier les routes réseau
ip route show

# Analyser le trafic réseau
sudo tcpdump -i any port 8080

Conclusion

Exposing a local service on the Internet requires careful configuration of port forwarding, security, and monitoring. While this approach is perfect for development or personal projects, consider more robust alternatives (VPS, CDN, cloud services) for production use.

The important thing is to always keep security in mind: use strong passwords, update your system regularly, and monitor access to your exposed services.

Feel free to share your experiences and questions in the comments!

Related articles

HyperFrames-Gradle : Transforming AsciiDoc into MP4 Video
31 May 2026
Auditing my LLM Consumption: SQLite, OpenCode, Ollama Cloud, and Why My Pro Subscription Blows the Global Market Away
18 May 2026
The "Independent Plugin + Consumer Root" Architecture: Why My Gradle Builds Are Doubling
14 May 2026
The Knowledge Graph as a Recommendation Engine: How I Killed Chronological "Related Articles"
12 May 2026