Skip to main content
R1chou
R1chou
New Member
June 24, 2021
Question

Can't reach external remote server on specific port

  • June 24, 2021
  • 1 reply
  • 5563 views

Hello,

 

I'm trying to connect thru MSTSC to a remote server on port 3432 (I don't manage this server or the firewall)

I have a rule that's allow me to access all ports (from lan to wan)

When I use policy lookup it shows me that rule.

I tried to create a specific rule for this specific server and specific port but it doesn't change anything.

 

When I try to reach this server from my personnal connection I can connect to it.

 

How could I troubleshoot to be sure that everything is ok on my site ?

 

Regards,

    1 reply

    Patel
    Patel
    New Member
    June 25, 2021

    Hello,

     

    Looking at what you mentioned, it looks like you are already allowing the traffic to flow through the FortiGate.

    If the server is on the Internet, then please check if you have NAT enabled on the policy.

     

    Furthermore, you can use the following commands to sniff the traffic on the FortiGate and confirm if the FortiGate is allowing the traffic and NATing it properly or not.

     

    diagnose sniffer packet any "host <destination IP> and port 3432" 4 0 l

     

    If everything looks good on the FortiGate side, then it would be a nice idea to check sniff the traffic on the destination side and see if they are receiving it or not.

     

    Regards,

    Kavin

     

    R1chou
    R1chouAuthor
    New Member
    June 25, 2021

    Hi Kavin,

     

    Yes, Nat is enabled.

    Just tried your commande, here is the result (it tried 4 times and then stopped) :

     

    # diagnose sniffer packet any "host X.X.X.X and port 3432" 4 0 l
    interfaces=[any]
    filters=[host X.X.X.X and port 3432]
    2021-06-25 08:22:58.218131 port5 in Y.Y.Y.Y.54804 -> X.X.X.X.3432: syn 3033647415 
    2021-06-25 08:22:58.218316 wan1 out Z.Z.Z.Z.54804 -> X.X.X.X.3432: syn 3033647415 
    2021-06-25 08:22:59.233239 port5 in Y.Y.Y.Y.54804 -> X.X.X.X.3432: syn 3033647415 
    2021-06-25 08:22:59.233278 wan1 out Z.Z.Z.Z.54804 -> X.X.X.X.3432: syn 3033647415

     

    X.X.X.X = remote server

    Y.Y.Y.Y = my private ip address

    Z.Z.Z.Z = ours public ip address

    Patel
    Patel
    New Member
    June 26, 2021

    Hello,

    > 2021-06-25 08:22:58.218316 wan1 out Z.Z.Z.Z.54804 -> X.X.X.X.3432: syn 3033647415

    Looking at this output, it looks like the SYN packet was sent out using the correct public IP address.

    I would recommend to check the traffic on the other side or with your ISP as I don't think FortiGate is causing an issue with the traffic.

     

    Regards,

    Kavin

    Terms & ConditionsAccessibility statement