Difference between NAT (port forward) and just open a port

[Panja]

Probably a n00b question but hopefully someone is willing to help me out.

The following scenario:
I have a web server on my LAN and I want to expose my websites to the public through port 80 and 443.

Do I need to create a NAT rule and Port Forward (80 & 443) to my server's LAN IP?
Or do I just create a WAN firewall rule and open port 80 & 443 to my my server's LAN IP?

What's the difference?
As far as I can see when creating a NAT rule (Port Forward) there is automatically a WAN rule created for this so why not just only create the WAN rule instead of NAT?

[kiokoman]

you need to create a NAT rule and Port Forward (80 & 443) to your server's LAN IP
if you just open the port it will be open for the firewall itself
long story short you open the port in the firewall and then you tell the firewall to forward the incoming traffic to your internal lan

[Panja]

@kiokoman

Many thanks! That explains a lot.

[johnpoz]

@Panja said in Difference between NAT (port forward) and just open a port:

there is automatically a WAN rule created for this

You would be surprised at how many users, change that default of it creating the wan rule for them and then wonder why port forwarding doesn't work.

The nat/port forward rules are evaluated before the firewall rules.. But without the firewall rule the traffic would not be allowed. So yes you need both.

Now if you had a routed space behind pfsense that was not natted, then just the firewall rule would be enough. Say in the case of IPv6 - you don't need to do nat, just the rule allowing the traffic to the IP.

[Panja]

@johnpoz
I see. Thanks for your help as well! Appreciated.