DNAT for Internal Web Server

8 replies
8730 views

Hello Everyone,

I recently installed FG100E with Firmware V6.0.3build0200.

We are hosting Web Server(192.168.1.20) in Internal Network.

When we access the Web Server by URL(http://www.mycompany.com) from the internal network stations, I want to set up FG100E to map the public IP (64.60.158.250) returned by DNS lookup to private Web Server IP(192.168.1.20).

What is the correct way of doing in FG100E?

Can we use Virtual IP without policy?

Or Virtual IP with self directing policy(Internal => Internal) will work ?

hubertzw

New Member

If I good understand you don't want to use a private IP address even for the local users, correct?

You can check this feature:

https://cookbook.fortinet.com/configure-hair-pinning-fortigate/

johnlee43Author

New Member

Hi hubertzw,

Thank you for replying to my question.

We are running local network behind firewall with local private IP's. All outbound traffic source addresses are SNATed to the external interface IP of the firewall.

My question is how FG100E handles the traffic from internal network to the external interface network, that is, the source address of the packet is the internal address like 192.168.1.x and the destination address is one of the public addresses from the subnet of the external interface like 64.60.158.x/29 including the one assigned to the external interface itself.

Can it smartly find out the destination locally and DNAT implicitly or we need to do DNAT ourselves ?

hubertzw

New Member

Hi, for the outbound traffic FG keeps session about specific connection including source IP, SNAT usually with unique port, destination, etc. For the returning traffic FG tries to find the existing session and for that one you don't need DNAT. But when you initiate connection from outside (incoming traffic) you need a policy with destination IP of the VIP object (policy NAT) or real (inside) host IP and then mapping in the DNAT table (only with the central NAT settings).

Sign up

Login with SSO

Login to the community

Login with SSO