Inbound NAT

Forum|Forum|6 years ago
March 10, 2020
4 replies
4033 views

Looking for some help with this issue. Possibly an aspect of NAT/Networking that I am not understanding. I have VOIP devices that are exposing themselves to the internet and I cannot find a way to deny unwanted inbound traffic wan>lan. This is happening even though the devices are not being port forwarded or use a virtual IP (made by me). But I am able to complete port connection tests to the source NAT port from remote IPs that are not on the destination NAT table... how? My logs say that the wan>lan traffic enters via the same policyID that allows them to connect outbound.

This policy is locked to a specific set of IP addresses on SIP so it should not be allowing connections to anything else (if anything).

6.2

Toshi_Esumi

SuperUser

No one would be able to comment without seeing the VIP and policy config (CLI) in question.

Dave_Hall

New Member

I agreed with Tosh, though reading the description itself of the problem, it's more a VOIP issue - At the back of my head, I keep thinking the issue may be related to the SIP ALG or SIP session helper.

milton24Author

New Member

Thanks for the replies. I'll check out the SIP links.

Log output from an accepted external connection to my VOIP phone: type="traffic" subtype="forward" level="notice" srcip=<external IP> srcport=61567 srcintf="wan1" srcintfrole="wan" dstip=<my wan IP> dstport=<dynamic NAT port> dstintf="lan" dstintfrole="lan" sessionid=14297519 proto=6 action="accept" policyid=13 policytype="policy" poluuid="610e0e98-b6d6-51e7-9796-633a14f4af69" service="tcp/<dynamic NAT port>" trandisp="dnat" tranip=<internal VOIP device IP> tranport=<dynamic NAT port> duration=261 sentbyte=0 rcvdbyte=0 sentpkt=0 rcvdpkt=0 appcat="unscanned" sentdelta=0 rcvddelta=0

Policy 13 ACCEPT: config firewall policy edit 13 set name "VOIP-Outbound" set uuid 610e0e98-b6d6-51e7-9796-633a14f4af69 set srcintf "lan" set dstintf "wan1" set srcaddr "VOIP-PhoneRange" set dstaddr "VOIP-Services-Group" set action accept set schedule "always" set service "SIP" "NTP" set utm-status enable set ssl-ssh-profile "certificate-inspection" set dnsfilter-profile "default" set ips-sensor "high_security" set logtraffic all set nat enable next end

VIP settings, they are whitelisted to external IPs and tested to only accept from them. The dynamic NAT port is not being forwarded here and the VOIP device IP is also not here. config firewall vip edit "MobileDomain-VIP" set uuid 8532f9a4-b952-51e7-a122-c18b82547b69 set extip <fortigate lan interface IP> set extintf "lan" set mappedip <internal server IP> next edit "PortForward10000" set uuid 47bd21f4-e3b2-51e8-6112-166c02ce0a72 set extip <wan IP> set extintf "wan1" set portforward enable set mappedip <internal server IP> set extport 10000 set mappedport 10000 next edit "PortForward443" set uuid 6925bdb2-f38c-51e8-7fbf-bd43d6b4ef7b set extip <wan IP> set extintf "wan1" set portforward enable set mappedip <internal server IP> set extport 443 set mappedport 443 edit "PortForward-22" set uuid 516e8ede-f390-51e8-c380-23c37e3991d9 set extip <wan IP> set extintf "wan1" set portforward enable set mappedip <internal server IP> set extport 22 set mappedport 22 next end

Sign up

Login with SSO

Login to the community

Login with SSO