portfwd

Kernel NAT port forwarder with expiring rules and SQLite state.

Documentation: see docs/USAGE.md.

Running portfwd with no arguments opens the TUI.

Build

go build -o portfwd ./cmd/portfwd

Quick start

sudo ./portfwd add \
  --listen 0.0.0.0:2222 \
  --to 10.0.0.5:22 \
  --proto tcp \
  --source 1.2.3.4/32 \
  --expires 12h \
  --public

List and inspect:

sudo ./portfwd list
sudo ./portfwd show <id>

Delete:

sudo ./portfwd delete <id>

TUI:

sudo ./portfwd tui

Cleanup expired:

sudo ./portfwd cleanup --quiet

Notes

• Requires root for iptables and sysctl net.ipv4.ip_forward=1.
• Defaults to 127.0.0.1/32 source if you do not pass --source and you are not using --public.
• --public is required if the listen IP is 0.0.0.0 or :: and requires explicit --source or --allow.
• State is stored in /var/lib/portfwd/portfwd.db (override with --db for testing).

Persistence

Use export-iptables to generate a restore file:

sudo ./portfwd export-iptables > /etc/portfwd/rules.v4

Then install the systemd unit from dist/systemd/portfwd-restore.service.

Cleanup scheduling

Systemd timer files are in dist/systemd/. Cron example is in dist/cron/portfwd.

portfwd