Skip to main content
Camilian
Camilian
New Member
February 13, 2018
Question

forward HTTP (80) and HTTPS (443) on router

  • February 13, 2018
  • 1 reply
  • 18150 views

I have FortiWIFI 60E. I have a domain name with my public routed IP address.

I am working on adding a web page to my server.

I configured IIS and DNS but is not working.

 

I need to forward HTTP (80) and HTTPS (443) traffic on my router (FortiWIFI) from the public IP address to the server local IP address. Can you please let me know what I need to do?

 

Thank you

 

 

 

 

 

1 reply

emnoc
emnoc
New Member
February 13, 2018

Fortinet has a  few cookbook and articles. Here's one for example.

 

http://cookbook.fortinet.com/port-forwarding/

ericli_FTNT
Staff
ericli_FTNT
Staff
February 14, 2018

Hi Camilian,

 

A series of VIP or virtual servers configuration could help you out of this.

 

Let's say, 10.10.10.1/30 is your Internet public IP, which is configured on the "wan" interface of your FortiWifi.

192.168.1.1/24 is your server-1(80), which connected with port1 of the Fortiwifi.

192.168.2.1/24 is your server-2(443), which connected with port2 of the Fortiwifi.

 

Now, firstly you need to configure 2 VIPs.

 

config firewall vip     edit "Server-1"         set extip 10.10.10.1         set extintf "wan"         set portforward enable         set mappedip "192.168.1.1"         set extport 8080         set mappedport 80     next

    edit "Server-2"         set extip 10.10.10.1         set extintf "wan"         set portforward enable         set mappedip "192.168.2.1"         set extport 8443         set mappedport 443

    next

end

 

Second, you need to configure a policy with these two VIPs.

config firewall policy

edit 1         set name "To_Server-1"         set srcintf "wan"         set dstintf "port1"         set srcaddr "all"         set dstaddr "Server-1"    ### The first VIP you configured.         set action accept         set schedule "always"         set service "ALL"         set logtraffic all         set nat enable

next

edit 2

edit 1         set name "To_Server-2"         set srcintf "wan"         set dstintf "port2"         set srcaddr "all"         set dstaddr "Server-2"    ### The first VIP you configured.         set action accept         set schedule "always"         set service "ALL"         set logtraffic all         set nat enable

next

end

 

Now, you should be able visit your 2 servers from Internet. For your 80 server, use URL "http://10.10.10.1:8080" and for 443 server, use URL "https://10.10.10.1:8443".

emnoc
emnoc
New Member
February 14, 2018

Good examples, but I would not do that.

 

1: no need for NAT enable in the two fwpolicies ( it will work but understand what NAT is actuallky doing a DNAT  VIP )

 

2: 2nd I would define fwpolicy for a port-based_forwarding  VIP with understand the  fact it's a port-based-forwarding

 

OUtside it's 2 thumbs up from me

 

Ken

 

Terms & ConditionsAccessibility statement