Skip to main content
papapuff
papapuff
New Member
December 7, 2018
Solved

Make internal Web Server accessible to outside using WAN with NAT (private IP)

  • December 7, 2018
  • 4 replies
  • 9765 views

hi there,

 

need advice and guidance.

I've created virtual Ip and its grup.

and already make DDNS for my WAN connection.

policy also already create it.

 

I try to enter web address (ddns ID I've registered), but page not found.

 

Am I missing something?

 

my internet connection is behind NAT.

 

thank you.

    Best answer by ede_pfau

    Just in case you DO get a public address but just not on the WAN port of the FGT...

    Then it would matter how the internet router hands down traffic to the FGT. Most preferably it would be called "exposed host" or such, effectively forwarding all traffic to the FGT's WAN port. You would then use a VIP on the WAN interface to NAT traffic to an internal target.

    4 replies

    lobstercreed
    lobstercreed
    New Member
    December 7, 2018

    I'm afraid you're missing the point from the other thread.  It is impossible to route across the Internet to a private IP address.  There are millions of networks that use the same private addressing, so how could the routers of the Internet know where to deliver that particular traffic?  They can't, and by design they drop that traffic (RFC 1918). 

     

    You HAVE to have a public IP address if you want to be able to remotely access anything (SSL VPN, IPSEC VPN, DDNS, etc).  If your ISP won't give you a public IP, maybe they can port-forward for you as I described on your other post.  That's the only way it can work....fundamentals of the Internet here.  

    ede_pfau
    SuperUser
    ede_pfauAnswer
    SuperUser
    December 7, 2018

    Just in case you DO get a public address but just not on the WAN port of the FGT...

    Then it would matter how the internet router hands down traffic to the FGT. Most preferably it would be called "exposed host" or such, effectively forwarding all traffic to the FGT's WAN port. You would then use a VIP on the WAN interface to NAT traffic to an internal target.

    papapuff
    papapuffAuthor
    New Member
    December 10, 2018

    hi there,

     

    thanks for answers.

     

    I've asked, provider not possible to forward the port. And yes Ede_pfau, got you mean, thanks for reminder.

     

    well, so there is no way to publish internal web server where there is no public address. I though setting "use ip public" on menu DNS, fortigate somehow can convert private ip to public IP

     

    thanks all for help.

    Terms & ConditionsAccessibility statement
    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.