The remote client normally does not need inbound port forwarding. The Data Relay Link server side still needs a reachable public entry point for control, enrollment, and published service ports.The diagram is useful for separating where the server lives from which Data Relay Link mode it uses. A private server behind DNAT can still run Direct mode; Enterprise single-443 is a different transport layout for constrained client networks.
In single-443, the public firewall only forwards the frontend control/enrollment endpoint on TCP 443. The internal backends remain loopback-only on the Data Relay Link server:
Public firewall TCP 443 -> Data Relay Link server TCP 443 frontendData Relay Link server 127.0.0.1:7000 -> relay backendData Relay Link server 127.0.0.1:6099 -> enrollment/management backendPublished service ports -> 6000-6098 (normally 1:1)
Do not DNAT public TCP 7000 or 6099 to the server in Enterprise single-443. Those are internal backend listeners in this topology. Exposing them defeats the intended single-443 boundary.
The distinction between a public port and a local listen/backend port matters when the server is behind NAT. Always configure the client with the public endpoint and configure the firewall to forward to the intended local listener.
Keeping public 6001 -> internal 6001 means the product’s persistent reservation is also the port users actually connect to.If an external firewall arbitrarily remaps every service port, the registry and Internet-facing endpoint stop matching, which makes operations and troubleshooting harder.
An internal user may fail to reach fw.example.com if that hostname resolves to the firewall’s public IP and the firewall does not support hairpin NAT.If hairpin NAT is unavailable, use split DNS or another appropriate internal routing design.
