Expose only the services visitors need. For a normal public website that means HTTP and HTTPS, while management ports stay private.
External requests to ports 80 and 443 should reach the Pi, while management services remain inaccessible from the public Internet.
Step-by-step
Confirm the Pi LAN address
Verify the reserved local address before creating any forwarding rule.
hostname -IFind the router port-forwarding screen
Look for NAT, Port Forwarding, Virtual Server, Applications & Gaming, or Advanced Firewall. The wording depends on the router.
Forward TCP 80 to the Pi
Create a rule mapping public TCP port 80 to TCP port 80 on the Pi LAN address. This permits plain HTTP requests and is commonly needed for redirects or certificate workflows.
Forward TCP 443 to the Pi
Create a second rule mapping public TCP port 443 to TCP port 443 on the Pi. HTTPS is the normal production path.
Do not expose administration unnecessarily
Do not forward MySQL 3306. Avoid public forwarding of SSH 22 and CloudPanel 8443 unless you have a specific secured design. Administration can stay LAN-only or be reached through a VPN.
Test from outside your Wi-Fi
Use a phone on cellular data or another external network. Testing from inside the same LAN can be misleading on routers that do not support NAT loopback.
Check for CGNAT if nothing reaches you
If your router WAN address is private or differs from the public address reported by an external service, your ISP may use carrier-grade NAT. In that case, normal inbound port forwarding may not work until the ISP provides a routable public address or you use another architecture.
External requests to ports 80 and 443 should reach the Pi, while management services remain inaccessible from the public Internet.
Troubleshooting
If a command or screen differs from the lesson, stop and verify the version you are using before forcing a change.
What you learned
You now understand the purpose of this part of the system and have a concrete result you can verify before continuing to the next lesson.