I am having issues setting up a DMZ port on my Firewall (hardware router). I am also assuming this belongs in Super User, as it seems like a basic DMZ setup. Here is the setup:
I have a
Fortigate 90D Firewall (
FortiOS 5.4) setup with 2 WAN ports being used by different ISPs. The LAN ports are all used for our internal network, except the 1 to be used as a DMZ port.
I'm trying to change the 1 LAN port to a DMZ port, so we can have a WiFi router in use that doesn't connect to our internal network. The WiFi Router is a
LinkSys EA2700 (http://www.linksys.com/us/p/P-EA2700/), but the problem I end up having is the LinkSys Router will connect to the Firewall, just not the internet.
Here is what I could find, but did not work:
- Setup port as DMZ (take out of Internal and place into zone named DMZ) and the Zone is set to block
Intra-Zone Traffic(box is checked)
- Setup port (in network > interfaces) with an address (I.E.
172.16.0.254/255.255.255.0) and the role DMZ (DHCP should be handled by LinkSys)
- Setup a Virtual IP using the WAN interface with the external IP and the mapped IP (external IP is the public internet IP, and Mapped IP is the
172.16.0.254set on DMZ interface)
- Setup Firewall Policy to allow traffic coming in from the WAN and going out through the DMZ, and set the destination address to the virtual IP (NAT is turned off)
- LinkSys is plugged into DMZ port and is only being used for WiFi with DHCP
- Internet settings is set to:
172.16.0.1/255.255.255.0Gateway and DNS:
- Local Network is set to:
172.16.1.1/255.255.255.0w/ DHCP enabled and set to use static DNS
172.16.1.1(NAT is enabled as well)
With this setup, remember the devices are connected like this: Modem -> Fortigate FW -> LinkSys Wifi Router.
The other ports are working fine, but when connected to the Wifi Router, I can ping 172.16.1.1, 172.16.0.1, 172.16.0.254, and the public ip (set in virtual IP) fine. I have also tried setting the Virtual IP to point to 172.16.0.1 instead of 254, but no change.
On the Fortigate, i can track the packets being sent from the DMZ interface, and it shows when I attempt to ping 188.8.131.52,
172.16.0.1 -> 184.108.40.206 icmp: echo request. I never see anything going from 220.127.116.11 -> 172.16.0.1/254.
I know the Firewall appears to be stopping the traffic, but I don't know if it is something i'm missing or not configured correctly.