Skip to main content
Allferry
Allferry
New Member
January 11, 2021
Solved

Policy to allow SSH from a specific External IP?

  • January 11, 2021
  • 4 replies
  • 14685 views

Hi lovely guys,

 

Can you point me to how can i create a policy to allow an external IP to SSH to a specific internal server? I have tried the below but server still can't be reached.

 

I've tried to add the external in Policy & Object>Addresses: Name: External_SSH_Access Type: Subnet IP: xxx.xxx.xxx.xx Interface: Any

 

And added a policy in Policy & Object>IPv4 Policy

Name: SSH_Access Incoming: Wan1 (My wan port)

Outgoing: Prod Network (network where Server is)

Source: External_SSH_Access

Destination: Server_to_SSH (via VIP that points to WAN IP to LAN IP with port 22)

Schedule: Always

Server: SSH

Action: Accept

NAT:Off

Enable this policy: On

 

Done all these, but i the person in this External IP can't reach the server.

 

Any ideas on what am i missing, please. You help is much appreciated.

    Best answer by pyy

    Hello Allferry,

     

    If you want to use the same public for the VIP and the firewall external check if your fortigate is listening on port22. If it is then you have 2 options:

    1. Change the FG ssh ports to something else

    2. Perform PAT in the VIP saying that if you request port 2222 translated to your server ip port 22. The server will be accessible from the remote ip as your-publicip:2222

     

     

    4 replies

    Herbert_k3
    Herbert_k3
    New Member
    January 11, 2021

    Hello,

    On the VIP object you can specify a permitted source address by set src-filter command, example:

     

    FortiGate # sh firewall vip FAC_SSH

    config firewall vip edit "FAC_SSH" set uuid 4fb2d328-5416-51eb-63ce-2697c2a45f2c set src-filter "192.168.15.49" set extip 192.168.103.10 set mappedip "10.10.10.254" set extintf "any" set portforward enable set extport 2222 set mappedport 22 next end

      Markus
      Markus
      New Member
      January 11, 2021

      Hello and welcome to the forums

       

       

      Try match-vip enable (on the policy in cli)

       

      Best

      pyy
      pyyAnswer
      New Member
      January 11, 2021

      Hello Allferry,

       

      If you want to use the same public for the VIP and the firewall external check if your fortigate is listening on port22. If it is then you have 2 options:

      1. Change the FG ssh ports to something else

      2. Perform PAT in the VIP saying that if you request port 2222 translated to your server ip port 22. The server will be accessible from the remote ip as your-publicip:2222

       

       

      JerryPWhite1
      JerryPWhite1
      Explorer
      January 11, 2021

      pyy wrote:

      Hello Allferry,

       

      If you want to use the same public for the VIP and the firewall external check if your fortigate is listening on port22. If it is then you have 2 options:

      1. Change the FG ssh ports to something else

      2. Perform PAT in the VIP saying that if you request port 2222 translated to your server ip port 22. The server will be accessible from the remote ip as your-publicip:2222

       

       

      Yep. Easiest way is to change the SSH port on outside interface to something else.

      Allferry
      AllferryAuthor
      New Member
      January 15, 2021

      Thanks Guys,

       

      I'll try this last approach.

       

      Many thanks

      Allferry

      NoPurposeInLife
      NoPurposeInLife
      New Member
      January 15, 2021
       

      1. Put the rule at the top of the IPv4 Policy

      2. Change the source to ALL

       

      If both this two works, you can ensure that your rule is working as expected. However, if it doesnt work when both steps is done, i would suggest checking the port forwarding configuration under "Policy & Objects" > "Virtual IPs". Make sure that an IPv4 Virtual IP and IPv4 Virtual IP Group is created for the connection

      Terms & ConditionsAccessibility statement