Port forwarding tells your router: "Any traffic arriving on this port, send it to this internal device." It works. It also tells the entire internet that something is listening on that port.
The Attack Surface Problem
From the moment you forward a port, automated scanners find it. Bots attempt SSH brute-force attacks on port 22. Vulnerability scanners probe for known exploits. Anyone with a port scanner can discover your forwarded service and start probing it. You need strong credentials, regular patching, rate limiting, and monitoring to keep it secure — for every forwarded port, on every site.
The Outbound-Only Alternative
ProxyPass nodes make only outbound connections. There is no listening port. There is no service discoverable from the internet. A port scanner aimed at the remote network finds nothing related to ProxyPass, because nothing is accepting inbound connections.
The tunnel exists, but it is initiated from inside the network. Traffic flows through this outbound connection in both directions — but the critical point is that no external entity can initiate a connection to the node.
Scenario: The Security Audit
Your company undergoes a security audit. The auditor runs an external port scan against all your remote sites. With port forwarding, the scan reveals open ports — SSH on 22, RDP on 3389, maybe a web interface on 8080. Each open port generates a finding that requires documentation, risk assessment, and mitigation evidence.
With ProxyPass, the port scan reveals nothing. No open ports. No discoverable services. The auditor notes: "External attack surface: no open ports detected." That section of the audit is complete. No findings, no remediation, no follow-up.
Where the Security Boundary Sits
This does not mean ProxyPass provides zero attack surface. The ProxyPass cloud server accepts connections — that is where the security boundary sits. But that server is managed infrastructure with TLS, API key authentication, rate limiting, and node blocking capabilities. The security responsibility is centralized on one well-secured endpoint, not distributed across dozens of forwarded ports on devices in networks you do not control.
For compliance frameworks that require minimizing attack surface — ISO 27001, SOC 2, NIST — outbound-only connections satisfy requirements that port forwarding fundamentally cannot.