Can Fortigate establish TCP connection like a real Reverse proxy?

Hi FortiMaster

As you may know we usually use DNAT/VIP to publish servers. But if ypu want it like reverse proxy I guess you need to configuer proxy rule instead of firewall rule. Well I'm not sure and didn't test it but I think you should dig in that side.

Hi all, I have done several tests:

Test computer 3.3.3.3 --> Internet --> External firewall (1.1.1.1:443) --> Final server(2.2.2.2:8080).

In case 1 I have tested with a normal VIP, case 2 with a virtual server (reverse proxy?)

1)If I connect from my computer, on internet, to public IP 1.1.1.1:443 maped to an internal server 2.2.2.2 port 8080 (It's a VIP with Deep inspection on the rule).

Result--> I see source IP (3.3.3.3) on final server with same source port than the original one TCP source port received on external firewall
Example : 3.3.3.3:5000 --> 1.1.1.1:443-->Real server receives traffic from 3.3.3.3:5000

2)If I connect from my computer, on internet, to public IP 1.1.1.1:443 maped to an internal server 2.2.2.2 port 8080 (its a virtual server balanced with host fqdn that maps public IP 443 to 8080 internal server, with Deep inspection on the rule):

Result--> I see source IP (3.3.3.3) on final server with different source port than the original one TCP source port received on external firewall .

Example : 3.3.3.3:5000 --> 1.1.1.1:443-->Real server receives traffic from 3.3.3.3:3450

The resume is that the source port, changes when I use Virtual server with host balancing method. This means that Fortigate acts a reverse proxy maybe?

Thanks