0

I am having issues setting up a DMZ port on my Firewall (hardware router). I am also assuming this belongs in Super User, as it seems like a basic DMZ setup. Here is the setup:

I have a Fortigate 90D Firewall (FortiOS 5.4) setup with 2 WAN ports being used by different ISPs. The LAN ports are all used for our internal network, except the 1 to be used as a DMZ port.

I'm trying to change the 1 LAN port to a DMZ port, so we can have a WiFi router in use that doesn't connect to our internal network. The WiFi Router is a LinkSys EA2700 (http://www.linksys.com/us/p/P-EA2700/), but the problem I end up having is the LinkSys Router will connect to the Firewall, just not the internet.

Here is what I could find, but did not work:

  1. Setup port as DMZ (take out of Internal and place into zone named DMZ) and the Zone is set to block Intra-Zone Traffic (box is checked)
  2. Setup port (in network > interfaces) with an address (I.E. 172.16.0.254/255.255.255.0) and the role DMZ (DHCP should be handled by LinkSys)
  3. Setup a Virtual IP using the WAN interface with the external IP and the mapped IP (external IP is the public internet IP, and Mapped IP is the 172.16.0.254 set on DMZ interface)
  4. Setup Firewall Policy to allow traffic coming in from the WAN and going out through the DMZ, and set the destination address to the virtual IP (NAT is turned off)
  5. LinkSys is plugged into DMZ port and is only being used for WiFi with DHCP
  6. Internet settings is set to: 172.16.0.1/255.255.255.0 Gateway and DNS: 172.16.0.254
  7. Local Network is set to: 172.16.1.1/255.255.255.0 w/ DHCP enabled and set to use static DNS 172.16.1.1 (NAT is enabled as well)

With this setup, remember the devices are connected like this: Modem -> Fortigate FW -> LinkSys Wifi Router.

The other ports are working fine, but when connected to the Wifi Router, I can ping 172.16.1.1, 172.16.0.1, 172.16.0.254, and the public ip (set in virtual IP) fine. I have also tried setting the Virtual IP to point to 172.16.0.1 instead of 254, but no change.

On the Fortigate, i can track the packets being sent from the DMZ interface, and it shows when I attempt to ping 8.8.8.8, 172.16.0.1 -> 8.8.8.8 icmp: echo request. I never see anything going from 8.8.8.8 -> 172.16.0.1/254.

I know the Firewall appears to be stopping the traffic, but I don't know if it is something i'm missing or not configured correctly.

0

The Virtual IP wasn't necessary, but the issue turned out to be the DMZ Zone had Block Intra-Zone Traffic checked. It is just a Custom Zone named DMZ, but I did not realize Block Intra-Zone Traffic was checked or what it did.

Normally this would block connections between each interface in the zone (according to http://firewallguru.blogspot.com/2008/11/intra-zone-traffic.html), but this apparently includes WAN ports as well (and i cannot assign a WAN port to the zone in this case).

The only other thing that needed fixed was on the LinkSys router, the wifi network needed to use the gateway as the DNS Server (172.16.0.254 according to the example).

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.