Skip to main content
syldor
syldor
New Member
October 5, 2015
Question

Open external access to a web server

  • October 5, 2015
  • 2 replies
  • 31475 views

Hi,

 

I have an internal web server with a fixed IP. 

The external access is provided by Fortinet router, with only one public IP for the whole network.

I want to allow external access to that server (and after multiple servers) with a DMZ and started to configure a DMZ interface, a virtual IP and corresponding policies as shown here:

http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/objects.067.08.html

 

However I have some questions:

- Is that method the good one for my use case ?

- When creating the virtual IP address, I have to put the external IP address. I just have one, so how can I manage the access to multiple internal web servers ?  

 

Many thanks, 

    2 replies

    gschmitt
    gschmitt
    New Member
    October 5, 2015

    syldor wrote:

    - Is that method the good one for my use case

    Yes

    - When creating the virtual IP address, I have to put the external IP address. I just have one, so how can I manage the access to multiple internal web servers ?  

     

    Use different ports is the only option

    syldor
    syldorAuthor
    New Member
    October 6, 2015

    Thanks gschmitt.

    So it looks like I have to do both port forwarding and DMZ interface, but port forwarding was implicit in the video, when setup HTTP Virtual IP, I can put any port instead of 80:80.

    gschmitt
    gschmitt
    New Member
    October 6, 2015

    syldor wrote:

    So it looks like I have to do both port forwarding and DMZ interface, but port forwarding was implicit in the video, when setup HTTP Virtual IP, I can put any port instead of 80:80.

    It's quite easy, go to Policy&Objects > Objects > Virtual IPs

    Create a New virtual IP

    External IP Address: YourExternalIP

    Mapped IP Address: YourInternalServerIP

    Port Forwarding checked

    Protocol TCP (in case of webservers)

    External Service Port 8080

    Map To Port 80

     

    Create a normal wan to internal policy from all to this VIP

     

    Now if you try to access YourExternalIP:8080 you get forwarded to YourInternalServerIP:80

     

    there is no DMZ interface on my fortinet unit. My webserver is connected to a switch that is connected to my fortinet unit.   Should I use one of the unattributed physical interfaces and physically connect my switch to it, and route data from the DMZ to the web server on my switch ?

    You got two options:

    Use any free single interface on the FortiGate. If you are in Switch Mode (all internal ports are connected) you can switch to Interface Mode and seperate them.

    If your switch can do VLANs you can create a VLAN Interface on your existing FortiGate interface. (System > Network > Interface - Create New; VLAN; enter VLAN ID)

    On the Switch simply add the port as a tagged port and the port the Server is connected to as an untagged port (or tagged if you enable VLAN on the NIC)

    Raymond3
    Raymond3
    New Member
    August 13, 2023

    Hi Team

     

    I have an issue doing Virtual IP on fortigate version 7.2.4. 

    does vip work on that version?

     

    Terms & ConditionsAccessibility statement