Skip to main content
Anonymous_User
Contributor III
May 11, 2011
Question

How to allow port 1443

  • May 11, 2011
  • 13 replies
  • 12989 views
I had added a custom Service under FIREWALL for TCP 1443 for destination and source . I also added a new address and created a policy base on it. However users are still unable to log into the website. Any idea? I am using 200A

    13 replies

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    May 11, 2011
    Hi, do you use a VIP to lead the traffic from WAN to internal port? It would help a lot if you could post - your FortiOS version - the policy - the config of your custom service One more, you are sure that you still use the default ports for administration of the Fortigate (http=80, https=443)?
    Anonymous_UserAuthor
    Contributor III
    May 11, 2011
    ORIGINAL: ede_pfau Hi, do you use a VIP to lead the traffic from WAN to internal port? It would help a lot if you could post - your FortiOS version - the policy - the config of your custom service One more, you are sure that you still use the default ports for administration of the Fortigate (http=80, https=443)?
    I am quite a novice to this device. How to check is it is VIP to lead the traffic? -Firmware version: v4.0,build0178,090820 (MR1)
    Citylight
    Citylight
    New Member
    May 11, 2011
    You definitely must follow Maiks advice and change the source ports. Otherwise it will work only in one case: the source is really 1443 and that' s a one-hit wonder. Citylight
    Maik
    Maik
    New Member
    May 11, 2011
    custom Service under FIREWALL for TCP 1443 for destination and source
    Change the source to 1024 - 65535 regards Maik
    Anonymous_UserAuthor
    Contributor III
    May 11, 2011
    Hi maik, isnt this opening up to more unneccessary ports?
    Maik
    Maik
    New Member
    May 11, 2011
    Hi maik, isnt this opening up to more unneccessary ports?
    no to get a feeling what' s going on, enter the " netstat.exe" command in a command shell of your windows client and study it' s output
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    May 11, 2011
    In case you wonder why everyone tells you to change the source ports and nobody tells you why: - TCP/UDP services use specific DESTINATION ports. You identify your HTTP custom service by the destination port 1443. Clients connecting to your server use random SOURCE ports so you have to allow a port range. But you only have to allow from port 1024 upwards as ports below are reserved for services. The highest possible port number is 65535 (=64K - 1). So that will fix your custom service definition. Again, if I could see your policy we could proceed from here.
    Anonymous_UserAuthor
    Contributor III
    May 12, 2011
    ORIGINAL: ede_pfau In case you wonder why everyone tells you to change the source ports and nobody tells you why: - TCP/UDP services use specific DESTINATION ports. You identify your HTTP custom service by the destination port 1443. Clients connecting to your server use random SOURCE ports so you have to allow a port range. But you only have to allow from port 1024 upwards as ports below are reserved for services. The highest possible port number is 65535 (=64K - 1). So that will fix your custom service definition. Again, if I could see your policy we could proceed from here.
    Thanks everybody. Here' s my policy and the edited source port range from 1024 to 65535
    Anonymous_UserAuthor
    Contributor III
    May 12, 2011
    cant embed 2 pics in one post?
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    May 12, 2011
    So you contact a remote server with a custom service. In order to have the reply traffic routed back to your network you have to enable NAT in the policy. Otherwise the server sends back replies to a private address which is not routed (" Users IP Range" ).
    Anonymous_UserAuthor
    Contributor III
    May 12, 2011
    Thanks Ede and pals here for your help!!!!
    Terms & ConditionsAccessibility statement