DMZ or IP Whitelisting

Whitelisting just vendor's IP address as source in a firewall policy should be sufficient in providing security in the access of the internal server. Create a service port for the database port if it does not exist on the firewall. A vip object mapping your external IP(WAN) to the internal server and port forwarding enabled for the database port. Apply the VIP object in the firewall policy as destination in the firewall policy

Hello

In addition to eowusu's suggestion, you need to add two firewall policies.

1. Fist one is to allow vendor's public IP to access your new VIP
2. Second one, below the first policy, to deny any other traffic from WAN to your new VIP

You may also add security profiles (IPS, AV and so) to the first policy.

Doing that way should be quite secure.

Hello  @k1rusty ,

Thank you for contacting the Fortinet Forum portal.

As explained by my colleague Eric and AEK can consider those processes please refer below article for procedure reference

1. create a custom port on the firewall  

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-custom-service-port-in-FortiGate/ta-p/283901Technical Tip: How to create custom service port i... - Fortinet Community

2. Add service by creating an external public ip VIP virtual IP for Natting to a private address.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-Virtual-IPs-to-configure-port-forwarding/ta-p/198195

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configuration/ta-p/198143

-Additionally to protect the server from unwanted traffic on public IP as well, add deny policy other than specified services to that VIP and make sure to enable match-vip on firewall policy from CLI 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Firewall-does-not-block-incoming-WAN-to-LAN/ta-p/189641

Best regards,

Manasa.

If you feel the above steps helped to resolve the issue mark the reply as solved so that other customers can get it easily while searching on similar scenarios.

@k1rusty 

Another option you can consider is using SSL VPN or IP Sec VPN. That would provide secure connection to the fortigate and not expose anything directly to internet. 

The option for whitelisting is also a good option, whichever is better suited for your environment. 

Regards, 

Varun