Most connections reach out to their device, and need nothing extra. Some connections instead listen for a device to connect in to them, for example a TSL UMD listener or a module with a return port. In a High Availability deployment, devices should connect through the cluster's virtual IP, because it moves to another machine if one goes down. To make a listening connection reachable on the virtual IP, add a port forwarding rule. The rule makes the virtual IP forward the port to whichever machine is running the connection at the moment.
Port Forwarding only appears in an HA deployment. On a single machine, devices connect to that machine's address directly and no rule is needed.