Replace port forwarding with a tunnel
Opening a port on the router puts the service on the whole internet. An outbound tunnel with login in front is safer and often easier.
The classic way to reach an office server from outside is to forward a port on the router: 3389 for remote desktop, 443 for a web app, 22 for SSH. That service is now visible to every scanner on the internet, all day.
A tunnel works the other way round. A small agent on your network connects out to a provider, such as Cloudflare Tunnel, Tailscale or a similar service, and the provider only lets authenticated users through. No inbound ports open on your router at all.
- Put an identity check in front: your company login with MFA, not just a shared password.
- Allow access per application and per group, instead of a whole network.
- Close the old forwarded ports once the tunnel works, and scan from outside to confirm.
- Log who connected to what. It’s usually built in.
I now set up every small office and home lab this way. It’s safer, and there’s no static IP to manage.