Skip to main content
MaeIstrom
MaeIstrom
New Member
August 28, 2025
Solved

Fortigate blocking random outgoing ports

  • August 28, 2025
  • 2 replies
  • 517 views

I have a fortinet v7.0.12 router and it's configured to nat and allow all traffic from the internal network to the internet. There's a firewall rule for internal -> wan with source/destination/Service set to 'all' and the security police is no-inspect. This seems to work for most things, internal users can access web site but some outgoing connections are blocked. Notably ports 8007 and 25 don't work. Where else would these connections be getting blocked if not the firewall?

Best answer by MaeIstrom

Just did a traceroute from one of machines behind the fortinet and the first hop was the routers internal IP the second is something other than it's public IP, same subnet but ending in .1. So apparently the ISP is doing NAT I guess

2 replies

ozkanaltas
ozkanaltas
Valued Contributor III
August 28, 2025

Hello @MaeIstrom ,

 

When you review forward traffic logs, can you see blocked traffic logs? 

 

If you are not, this traffic can be blocked by the ISP. Generally, ISPs don't like 25 traffic. Because of that, they can block 25 traffic.

MaeIstrom
MaeIstromAuthor
New Member
January 22, 2026

Port 25 seems to be working after an ISP change. 8007 is still blocked. More specifically port 8007 on a system that does port forwarding to 8007 on an internal ip. Or any port that is being DNATed. The machines behind the fortinet can access any other public ip or port. The DNAT system works for any other machine including ones behind an SNAT router. I've turned off SSL inspection and even unencrypted traffic just times out.

MaeIstrom
MaeIstromAuthorAnswer
New Member
January 22, 2026

Just did a traceroute from one of machines behind the fortinet and the first hop was the routers internal IP the second is something other than it's public IP, same subnet but ending in .1. So apparently the ISP is doing NAT I guess

Terms & ConditionsAccessibility statement