DMZ over VLAN to VM hosted on Internal network - problem

Question

Good Day experts,

So my idea is to have a webserver (hosted as VM via Windows HyperV) on my machine on the internal network, to be accessible via VLAN from DMZ interface on our Fortigate E61 FortiOS v6.0.4 build0231 (GA).

For the moment being, I know this sounds bad, but we're limited to the infrastructure currently available until we have this cloud hosted. We have the above mentioned fortigate unit and an ubiquity unifi managed switch between the internet and my local machine. My machine also has 2 NICs (one ethernet, the other Wifi)

I want to make said webserver accessible via the fortigate's DMZ port (on VLAN 20), which then goes to the same unifi switch as mentioned above (again, over VLAN 20) then to my local machine's ethernet NIC which is used exclusively by the VM for traffic.

These are the steps I have already taken:

[ol]

Created a virtual interface on my internal (Interface 1: 192.168.1.1) port addressed 192.168.2.1 255.255.255.0.

Created a Virtual IP (name: DMZ_VIP ext id: 11.22.33.44 mapped internal IP 192.168.2.10 interface: DMZ_VLAN) (with PING and HTTPS ports forwarded).

Created a policy with incoming interface: wan, outgoing: DMZ_VLAN, source: all, destination: IPRANGE 192.168.2.10 (since even though I have created a VIP, I an unable to to list it as the destination for some reason? I read that one has to disable central NAT or something?), NAT: off.

Created a policy with incoming interface: DMZ_VLAN, outgoing: wan, source: all (again, I can't specify my VIP), destination: all, NAT: off)

Created a VLAN 20 on the unify switch.

Setup HyperV's virtual switch to use my local machine's ethernet port with VLAN 20 and assigned it to my VM.

Set a static IP for the VM (192.168.2.10) with gateway IP 192.168.2.1[/ol]

Here are my results (as commands executed from the webserver at 192.168.2.10)

[ol]

I can ping the fortigate DMZ interface (DMZ_VLAN) at 192.168.2.1 - GOOD

I cannot ping anything else on my internal network since only the machine and DMZ_VLAN use VLAN 20 - GOOD

I cannot ping an outside service like google's DNS service (my go-to when testing internet connectivity) - BAD

I cannot reach my webserver's hosted IIS applications from the internet using the URL: https://11.22.33.44 - BAD

Nothing can ping the webserver from the internal network - GOOD.[/ol]

I still need to achieve the listed items above (specified as "BAD") (i.e. I need to hit the webserver from the internet, I neet the webserver to have internet access)

I hope I've explained with as much detail as possible. I've read up again and again but never quite see an article that addresses creating a VLAN on the DMZ port to a VM that's on the local internal network.

My knowledge and experience with networking is somewhat limited ( I mean I know ICMP atleast) and a few different things but I've been scouring the web with no luck as such on how to do this.

I have followed the cookbooks to setup a DMZ port but still run into the problem as mentioned above (I cannot set the policy's destination to a VIP, to allow wan traffic to my webserver). I have upgraded my firmware since but with no luck.

Please also see the screenshots of my actions attached.

rwpatterson · Accepted Answer

When you define the VIP, make sure you choose the correct outside facing interface or it will not display in the drop down.

RBotha · Answer

More Screenshots

Sign up

Login with SSO

Login to the community

Login with SSO