Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have serious problems setting up port forwarding on a Fortigate 50B. The unit is basically running as factory default, the wan1 interface is connected to my fibre optic internet modem, and my lan is connected to the internal switch of the Fortigate. The factory default firewall policy allowing traffic from the internal interface to wan1 is kept and I'm able to access the interet as normal.

Then I added a virtual ip and a firewall policy for allowing access from the internet to my local servers (ip 192.168.9.51) webserver (standard port 80). The settings I made are as follows.

Edit Virtual IP Mapping

Name : Server VIP
External interface : wan1
Type : Static NAT
Extermal IP Address/Range : 0.0.0.0
Mapped IP Address/Range : 192.168.9.51
Port Forwarding : not checked

Firewall policy

Source interface/Zone : wan1
Source address : all
Destination interface/Zone : internal
Destination address : Server VIP
Schedule : always
Service : HTTP
Action : ACCEPT
no other settings checked

What happens now is that I'm unable to access internet from my server, I'm not getting through to the webserver from internet either. I'm able to ping a site on the outside, but all web traffic is blocked, both ways.

I've checked the documentation, but as far as I can tell I have set this up correctly. Anyone here with knowledge of Fortigate port forwading/NAT?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Well .. I found the solution:

Edit Virtual IP Mapping

Name : Server VIP
External interface : wan1
Type : Static NAT
Extermal IP Address/Range : xxx.xxx.xxx.xxx  <- insert external IP here
Mapped IP Address/Range : 192.168.9.51
Port Forwarding : not checked

I turns out you have to input the external ip of the wan1 interface and not use 0.0.0.0 as the documentation states should be valid for any ip. That is crappy since all port forwardings will stop working if my wan interface changes ip-address after a powerloss for instance. But atleast it works now.

share|improve this answer
    
Later firmware fixes this bug. I can now use 0.0.0.0 as external ip –  sindre j Feb 23 '11 at 11:33

You definately need to check NAT on the firewall policy with your VIP if you're NATing everything going out. Try this first.

share|improve this answer
    
I've tried, no change. But according to the documentation this should not be nessesary. Quote: "If you select a virtual IP as the Destination Address, but do not select the NAT option, the FortiGate unit performs destination NAT (DNAT) rather than full NAT. Source NAT (SNAT) is not performed." –  sindre j Apr 21 '10 at 20:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.