Skip to main content
soheil_amiri
New Member
November 4, 2020
Solved

DNAT and virtual IP

  • November 4, 2020
  • 1 reply
  • 4627 views

hi guys 

i am new in fortigate world, 

what is different between these two way of publishing a service :

1- publish a server with using filtering \services\HTTP

2- publishing a server using port forwarder

 

are both work the same way and manner ?

is there any technical benefit between them ?

    Best answer by boneyard

    please change the second screenshot, it is just a lot of text code now.

     

    as for the question, there won't be a noticeable difference on traffic handling i believe. there probably is a difference on a deeper level, but you would have to be able to look at the source code for that. i would guess that one get dropped earlier, but again for resulting behaviour no difference.

     

    it does have an other effect though. the way with the filter make the IP address further unusable for other forwards to different IPs or ports. you have add HTTP for another port on the same IP, but if you want to also use the Virtual IP for port 25 to another internal IP then that won't be possible.

     

    while with the port forwarding virtual IP you can make different connections on the same public IP.

     

    1 reply

    boneyard
    boneyardAnswer
    Valued Contributor
    November 7, 2020

    please change the second screenshot, it is just a lot of text code now.

     

    as for the question, there won't be a noticeable difference on traffic handling i believe. there probably is a difference on a deeper level, but you would have to be able to look at the source code for that. i would guess that one get dropped earlier, but again for resulting behaviour no difference.

     

    it does have an other effect though. the way with the filter make the IP address further unusable for other forwards to different IPs or ports. you have add HTTP for another port on the same IP, but if you want to also use the Virtual IP for port 25 to another internal IP then that won't be possible.

     

    while with the port forwarding virtual IP you can make different connections on the same public IP.

     

    soheil_amiri
    New Member
    November 7, 2020

    thanks for your answer, 

    here is both picture