Skip to main content
hun
hun
New Member
September 30, 2024
Question

NAT/Proxy 443 on domain controllers to outside web server

  • September 30, 2024
  • 4 replies
  • 1541 views

How can I redirect Port 443 only to a different IP with the FortiGate?

 

Domain Controllers are in separate subnet, and all requests except port 443 should go to the real IP.

 

Port 443 should be redirected to an external webserver.

 

(for context: AD set up with split DNS, domain.com internal AD, and the same domain.com externally and we can't change or AD name, using www is not an option)

4 replies

AEK
SuperUser
AEK
SuperUser
September 30, 2024

If I understand well your request I think you need policy routes.

https://docs.fortinet.com/document/fortigate/7.4.5/administration-guide/144044

 

AEK
    ebilcari
    Staff
    ebilcari
    Staff
    September 30, 2024

    Are the DCs already reached through a VIP? If the VIP is in use than the IP of the real servers behind can be easily added/changed. When dealing with AD/DC I would prefer to go with a DNS approach (new sub/domain) as a cleaner solution and not create VIPs.

    Emirjon
      hun
      hunAuthor
      New Member
      October 2, 2024

      @ebilcari The DC's are currently reached through a regular firewall policy: Allow interface/subnet1 -> interface/subnet2 all source / DC IP destination / all services.

       

      I have read through and I agree that a new sub/domain would be cleaner, but this is currently not possible.

       

      Would you mind pointing me in the right direction with VIP? Can I create one that has the same IP as the DC? I would have assumed it would be a conflict.

       

      Also @AEK regarding policy routes, that looks interesting, but what would be the outgoing interface and gateway?

      Essentially we use SDWAN but I can not select that here, so I would have to select the WAN interface directly I assume. But what is meant by gateway? Is that my ISP's gateway?

       

      Thank you.

      ebilcari
      Staff
      ebilcari
      Staff
      October 2, 2024

      The idea was to create a VIP and point all the DNS A records to that IP, than based on the port (TCP/UDP) to forward the traffic to different real server IPs. This approach may work for other services, but it's too risky when dealing with AD/DC services, as it could potentially cause disruptions (multiple service ports and complex DNS records like SRV).

      Emirjon
        AEK
        SuperUser
        AEK
        SuperUser
        October 2, 2024

        It seems I misunderstood your initial post. So forget about the policy route.

        I don't think using a VIP with the same address as your DC is a good idea, I never tested it and I don't know if it actually works, since I find such solution/workaround not so clean.

         

        I don't have a solution in mind to implement in FortiGate level but in your case another possible solution is to implement HTTP redirection on your local DC web server. It is easy to implement and I find it much cleaner.

        AEK
          Terms & ConditionsAccessibility statement