@JonathanLee said in Good GUI Port Numbers: It’s the name applied in advanced settings for the firewall. Yours doesn’t do that ? I've my own rented domain name for my pfSense LAN networks. I use this domain name, let's call it "my-own-company.net" mostly internally. As this domain name does exist 'on the Internet', I rent it after all, I can easily about a (wild card) certificate. acme.sh using the most simple setup. I also rent some data center based servers, and some of them do the domain name server (DNS) handling for all my domain names. So, basically, no more DDNS hassle for me, as I became my own DDNS supplier. So i know where to find the admin if needed (its me). My ISP gives me static WAN IPv4s, and semi static IPv6 prefixes, so live is fine, as if DNS goes down, I know my IPv4 ^^ (my IPv6 is a bit harder). One pfSense to handle the ip/port NATting while IPv4 is still supported, and a simple firewall rule for IPv6, and done.

@emc This issue has been fixed. NAT is working. It was a firewall issue in the PBX. I've whitelisted the IPs on the PBX's firewall and it works. Thank you everyone for your help.

Technically you could do it by running pfSense as a virtual machine in Windows using hyper-V or VBox etc. But pfSense is a complete operating system, it cannot run as an application on your desktop. It expects to be running on it's own dedicated hardware but running virtualised can also work. Steve

Yeah you should be able to use either HAProxy or reverse Squid to redirect requests based on the host headers to different internal servers. Or different ports on the same server. https://docs.netgate.com/pfsense/en/latest/packages/haproxy-package.html https://youtu.be/FJSHMyrd29E Steve

Nat reflection is ALWAYS the worse option to choose.. I don't understand why anyone would ever want to nat reflect.. if host.domain.tld is on the same network next to you - then why would you not just resolve host.domain.tld to that IP.. Why would you ever want to go to the public IP to be reflected back in?? As to forwarding port X to port Y.. That is always a work around in itself to all to go to the same service with the limitation of napt and only 1 public IP, etc. If you want to go to host.domain.tld:port then go there where host.domain.tld resolves to the local IP and not the public ip..