USG FLEX 500H Port Forwarding Not Working for Ports 8000, 8001, and 443

Hi @Viper05 ,

To help troubleshoot why port forwarding for ports 8000, 8001, and 443 is not working on your USG FLEX 500H, please consider the following diagnostic steps:

1. Check for Service Port Conflicts (Specifically Port 443): By default, port 443 is utilized by the firewall for its own local web GUI management (HTTPS) and SSL VPN services. This default setting often conflicts with port forwarding rules attempting to use port 443. We highly recommend changing the firewall’s HTTPS management port (e.g., to 8443) under the system settings to free up port 443 for your NVR.
2. Verify Security Policy Destination: Ensure that your Security Policy rule allows the internal destination port and not the external port. Because the firewall processes NAT rules first, the security policy must allow traffic destined for the internal IP address and the actual port used by your NVR.
3. Double NAT Check: Verify if the WAN interface of your USG FLEX 500H is receiving a true Public IP address or a private IP address (e.g., 192.168.x.x, 10.x.x.x, or 172.16.x.x). If it is behind an ISP modem/router, you are in a Double NAT scenario, meaning those ports must first be forwarded from the ISP gateway to the WAN IP of the Zyxel firewall.
4. Isolate Testing Environment: Try testing connection attempts from an external network (such as a mobile hotspot or cellular data) rather than relying solely on NAT Loopback, as this helps rule out local routing issues.