Two wizards (from 1.1.29) do in a few questions what the guides Send your TVs through a VPN and Send chosen websites and torrent traffic through a VPN do by hand, and a third forwards ports from the internet to a device. They show every change before anything is applied and commit with the safety rollback and with clearing of old connections.

System › Wizards lists them:

Send devices through a VPN

System › Wizards › Send devices through a VPN. Five steps:

1. Devices: a range of addresses (for example .60–.69 for the TVs, like the guide), devices ticked from the DHCP list, or an existing address object. The wizard makes one address object for them and can give each device a fixed address in the range (a DHCP reservation), so a device cannot leave the VPN by getting another address. Whole networks and WireGuard remote users can be added too.
2. Tunnels: your existing WireGuard client tunnels with their state (online, offline, never answered). A tunnel that never answered has an outdated key or file: replace it with a new file from the provider. New tunnels can be imported here. The wizard turns the chosen tunnels on, warns when two tunnels have the same address (NordVPN gives every client 10.5.0.2) and offers /32, and adds the outbound NAT a tunnel is missing.
3. Failover: the order of the tunnels In order, Fastest (the lowest ping, see Check that traffic follows your changes), or Load balance. When the chosen tunnels share a provider account (the same key, such as several NordVPN servers), the wizard limits the connected tunnels, because the provider allows one connection per account: One tunnel per provider account when the tunnels belong to two or more accounts (NordVPN and IPVanish: one of each connected, the next provider takes over at once; the next release), Only the active tunnel when they all belong to one (from 1.1.30); you can change the choice under Connected tunnels; then fail-safe (the internet line as last resort: the devices never go offline) or kill switch (nothing outside the VPN). In order, tier 1 counts as down only after 6 lost pings, so it does not flap. Old connections are cleared at every switch.
4. Route: the devices' route is placed first, so no broader route catches their traffic. Other routes for the same devices (for example a separate Netflix route through another tunnel) are listed with Turn off, so each device has one exit address. If the devices and the internet line both have IPv6, the wizard warns and offers to block the devices' IPv6 to the internet, so the VPN cannot be bypassed over IPv6.
5. Review and apply: every change, then Apply (safety rollback, clearing old connections). The last page links to Traffic verification for the new route and to NAT translations, where the devices' translated address must be the tunnel's.

Custom port forward

System › Wizards › Custom port forward forwards ports from the internet to a device on your network.

1. Ports: a name, TCP, UDP or both, and the ports: one (32400), a range (27015-27030), several (80, 443), or translated (8443:443: the internet's 8443 to the device's 443).
2. Device: from the DHCP list or typed, with a warning when it has no fixed address (a reservation); optionally its IPv6 address for the matching IPv6 rule; which internet line(s).
3. Who may connect: anyone, or only listed addresses, objects or countries. NAT reflection lets your own devices use the public address too.
4. Check: clashes with existing forwards (with Turn off) and with the firewall's own services on that port (WireGuard, IPsec, OpenVPN, and on management zones the web console and SSH). A clash must be solved before the review.
5. Review and apply, then how to test from outside (a phone on mobile data) and a link to Traffic verification for the forward. If the firewall's internet address is private (a router in front of it), that router must forward the port too.

For ready-made server types (web, mail, game, remote desktop), Publish a server asks fewer questions.

The pictures are from the test firewall (version 1.1.29).