1

I've got a fortigate 40C here and copied the config mainly from a Fortigate60. Everything is working fine, but I've got some problems with the PPTP VPN connection. I want to add SSL VPN in the future, but for now PPTP is fine.

At the moment I got a working configuration, but some things are not working properly.

  • the DNS server is not pushed to the client. It should be 192.168.6.1 like via DHCP.
  • the client should use the gateway 192.168.6.1, not 192.168.160.1

I use the OS X VPN client to connect and I've added the dns entry + network settings manually, so it works.

Does anyone have an idea how to get the DNS + Gateway pushed properly to the client?


   config system dns
        set primary 8.8.8.8
        set secondary 8.8.4.4
        set domain "lan"
   end

config firewall address edit "all" next edit "Internal_Range" set subnet 192.168.6.0 255.255.255.0 next edit "PPTP" set associated-interface "wan1" set type iprange set end-ip 192.168.6.180 set start-ip 192.168.6.160 next end config firewall policy edit 1 set srcintf "internal" set dstintf "wan1" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "ANY" set nat enable next edit 50 set srcintf "wan1" set dstintf "internal" set srcaddr "PPTP" set dstaddr "all" set action accept set schedule "always" set service "ANY" next edit 4 set srcintf "wan1" set dstintf "wan1" set srcaddr "PPTP" set dstaddr "all" set action accept set schedule "always" set service "ANY" set nat enable next end config vpn pptp set status enable set eip 192.168.6.180 set sip 192.168.6.160 set usrgrp "Wizard_users" end config system dhcp server edit 1 set default-gateway 192.168.6.1 set domain "lan" set interface "internal" config ip-range edit 1 set end-ip 192.168.6.159 set start-ip 192.168.6.100 next end set lease-time 345600 set netmask 255.255.255.0 set dns-server1 192.168.6.1 next end config system interface edit "wan1" set vdom "root" set mode pppoe set allowaccess ping set type physical set alias "FTTB Fixed IP" set username "X@X" set password ENC X set defaultgw enable set dns-server-override disable next edit "modem" set vdom "root" set mode pppoe set type physical next edit "ssl.root" set vdom "root" set type tunnel next edit "internal" set vdom "root" set ip 192.168.6.1 255.255.255.0 set allowaccess ping https ssh set type physical set alias "LAN" next end

edit: The DNS server, the gateway are all on the Fortigate unit with the IP 192.168.6.1.

5
  • 192.168.16.1 is the gateway, the DNS server, and the IP of the internal interface for clients to use? Is your client receiving the DNS server config via DHCP (please verify)? Sorry I missed this, where is your DNS server? If it's the Fortigate's DNS server daemon, you might need to take some internal routing steps on the Fortigate.
    – mbrownnyc
    Dec 30 '13 at 16:06
  • @mbrownnyc DNS server is 192.168.6.1(the fortigate). the internal network is 192.168.6.1/24 and the VPN network is in the range 192.168.6.160-180
    – Paul
    Jan 2 '14 at 13:25
  • @mbrownnyc yeah, I added the DNS and search domain to the client,so that's fine. My main problem is that I don't get the gateway when I use the VPN as default connection. I can connect to the internal network just fine, however accessing external addresses doesn't work and I really have no idea what to change in the configuration to make it work nor can I find some documentation for that.
    – Paul
    Jan 2 '14 at 14:28
  • Can you confirm that the DNS server address is assigned to the client(s) as expected? Also look at the (old) VPN guide. Also, try debugging packet flow. You might need to handle internal routing (incoming WAN1 PPTP => Internal DNS server), but I can not find the commands to do so.
    – mbrownnyc
    Jan 2 '14 at 14:36
  • @mbrownnyc I saw that guide, but I can just find how to connect to the internal network, not how to get a working gateway over the VPN connection
    – Paul
    Jan 2 '14 at 14:45
0

I got it working now. I didn't see the NAT checkbox :(


edit 50
        set srcintf "wan1"
        set dstintf "internal"
            set srcaddr "PPTP"
            set dstaddr "all"
        set action accept
        set schedule "always"
            set service "ANY"
        set nat enable
    next

To the other part @mbrownnyc is right. The fortigate can't push the DNS server, Gateway or search domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.