A workflow with a node that listens for incoming traffic, such as a REST Server node, needs other systems to connect in to it. In a High Availability deployment, they should connect through the cluster's virtual IP, because it moves to another machine if one goes down. To make the workflow reachable on the virtual IP, add a port forwarding rule. The rule makes the virtual IP forward the port to whichever machine is running the workflow at the moment.
Port Forwarding only appears in an HA deployment. On a single machine, other systems connect to that machine's address directly and no rule is needed.
Rules belong to the whole workflow, not to a single node. If a workflow listens on more than one port, add one rule for each.