NAT (Network Address Translation) is a feature that allows multiple devices connecting using private (Internet unroutable) IP address space to operate in Internet via a single public IP address flewlessly. There are multiuple type of NAT available however the most common and the relevant for the sake of tomato and this documentation it's PAT.
PAT (Port Address Translation) is what tomato does by default, so essentially translation happens not only between [IP] but on a socket basis so [IP:Port]. So a request in Internt from e.g. 192.168.0.100 towards google.com will create a mapping to allow the return packets to be dispateched to the correct LAN device. All this magic happens transparently for LAN initiated connectivity but connection Initiated in Internet will never be able to reach a LAN IP as the PAT table doesn't cointain any reference to it. This is considered a great Security feature mainly but there are cases where you want to have one port on the WAN to be mapped/redirected always to a single LAN device.
NOTE: There's a legacy setting under Advanced/Routing/Miscellaneous that suggest tomato being able to operate in Gateway (defauly) or Router mode. Ignore this setting and always leave it to Gateway regardless of your network configuration.
When the traffic appen to be initiated from the Internet towards tomato's public IP on the WAN on a specific port this is either answered by tomato (if any service is enabled for that port) or dropped. There are cases though where you will want to have a WAN port redirected always to a specific LAN IP address. This is helpful for certian application like hosting an internal web/mail server, gaming, voice traffic, etc. The basic port porwarding page allows you to do exactly this:
On: enable or disable the line of configuration
Src Address: (optional) will restrict the rule only from specific source addresses. Contrary to the column name you can also use host names and FQDN here. Empty means “from anywhere”.
Ext Port: it defines the map itself, it can be an individual port or a range defines with the syntax “FromIP-ToIP”
Int Port: (optional)allows you to use a different port on the target LAN IP address. Empty will use the same port as per Ext Port
Int Address: where the port is to be redirected on the LAN
Description: free text to help you remember the reason for the mapping