Skip to main content
landonious
landonious
New Member
November 9, 2023
Solved

Proper way to setup multiple public ip addresses with multiple web servers

  • November 9, 2023
  • 3 replies
  • 29367 views

Hello. We have 3 public ip addresses and 2 web servers. I would like both to be behind the FortiGate but I want to make sure I set it up properly. From what I understand, I am not supposed to use both WAN interfaces and instead I am supposed to assign multiple ip addresses to one interface. If it matters, one of our ip addresses is on one subnet and the other two ip addresses are on a separate subnet. Ideally, the two webservers would use the single ip address and one of the other two. The only reason is that the dns records already point to these two and i don't want to change them if i don't have to. But if it's easier or better to use the two ip addresses that are on the same subnet, I can update everything as needed. I will still be using the same Fortigate and internet connection for all the devices on the network as well. What all do I need to do to set this up properly? Let's say the following:

 

Public IP address info:

Static Ip 123.45.25.105
Gateway 123.45.25.254
Subnet Mask 255.255.255.0

 

Static Ip 123.45.24.122
Gateway 123.45.24.254
Subnet Mask 255.255.255.0

 

Static Ip 123.45.24.123
Gateway 123.45.24.254
Subnet Mask 255.255.255.0

 

Sales Server 192.168.0.88 (only needs ports 80, 443, 8443) (ideally using public ip 123.45.25.105)

CentOS Server 192.168.1.75 (needs pretty much all ports) (ideally using public ip 123.45.24.122)

 

The CentOS server sends mail so it MUST use the same ip address for outgoing connections. I suppose I could add all the ip addresses to the spf record if absolutely necessary. But I would prefer to keep it all to one public ip address.

 

As far as every other device on the network, ideally I would like all traffic for that to use the third unused ip address, but I don't overly care about that part if it's a problem.

Best answer by pminarik

I would suggest the following as a start, then you can tweak further.

Decide what will be the "generic" IP that your local clients will use to connect to the internet (including the FortiGate itself). Use that as the IP address of the WAN interface.

 

Sales server: Use the public IP in a VIP object to create the 123.45.25.105->192.168.0.88 mapping. Apply further restrictions as needed.

 

CentOS mail server: Use the public IP in a VIP object to create the 123.45.24.122->192.168.1.75. In this case, consider not configuring any port translation, let it be a simple IP->IP mapping. The benefit of this is that it will automatically SNAT the server's outbound traffic to the external IP of the VIP as long as this outbound policy has SNAT enabled. (this "automatic SNAT to the VIP's IP" is a special scenario)

 

Don't forget to use these VIPs in firewall policies (as destination address object), this is what "enables" them.

 

sample configuration: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configuration/ta-p/198143

3 replies

pminarik
Staff
pminarikAnswer
Staff
November 10, 2023

I would suggest the following as a start, then you can tweak further.

Decide what will be the "generic" IP that your local clients will use to connect to the internet (including the FortiGate itself). Use that as the IP address of the WAN interface.

 

Sales server: Use the public IP in a VIP object to create the 123.45.25.105->192.168.0.88 mapping. Apply further restrictions as needed.

 

CentOS mail server: Use the public IP in a VIP object to create the 123.45.24.122->192.168.1.75. In this case, consider not configuring any port translation, let it be a simple IP->IP mapping. The benefit of this is that it will automatically SNAT the server's outbound traffic to the external IP of the VIP as long as this outbound policy has SNAT enabled. (this "automatic SNAT to the VIP's IP" is a special scenario)

 

Don't forget to use these VIPs in firewall policies (as destination address object), this is what "enables" them.

 

sample configuration: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configuration/ta-p/198143

    landonious
    landoniousAuthor
    New Member
    November 10, 2023

    So, to clarify, I do NOT add the the additional IP addresses as secondary IP addresses on the WAN interface?

    ebilcari
    Staff
    ebilcari
    Staff
    November 12, 2023

    It's not necessary to configure it as a secondary IP, FGT will respond to ARP requests for the IP that is configured as VIP, you can get more info on this article or in the admin guide.

    Regarding the first IP that is outside of the main subnet (123.45.25.105) it will not work with a simple VIP, unless these subnets are from the same ISP and it has static/dynamic routing to find this subnet through 123.45.24.122 as next-hop or another point-to-point interface.

    Emirjon
    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    November 11, 2023

    Exactly, use VIPs (DNAT) to "expose" your internal servers, not secondary IPs. The latter would just point to the FGT, not to any server.

    If you set up the 2 policies correctly, outbound traffic (which is not reply traffic) will be re-translated to the public IP specified in the VIP.

    Not using port translation has the by-effect that you'll lose that public IP completely for other purposes - it will act as the server's IP. So it should not be the one public IP you are using for IPsec VPN or such.

    Finally, if you need to translate 3 ports, define 3 VIPs and group them into a VIP group.

    landonious
    landoniousAuthor
    New Member
    November 14, 2023

    When I move my cPanel server over to the FortiGate, it cannot access the internet. I set the internal IP to 192.168.0.78 (which is where the VIP points to) and nothing. I can ping every single device on the local network no issues, but I cannot access anything beyond. If I simply change the ip to 192.168.0.76 (which is not referenced anywhere in the FortiGate...just a random unused ip address) it can access everything just fine. My thinking is that since the public IP we are using for this one (123.45.24.122) is different from the WAN interface (123.45.25.205) and uses a different gateway that this might be the problem. Does that sound right? The only static route I have setup is for the 123.45.25.205 IP which is 123.45.25.254. If you think this is the problem, can we get around this? I'm not sure how to set another static route for this, or is that possible?

     

    EDIT: of course, now that I've typed this, I realized that the windows server that is using ip 123.45.24.123 is not having any issues connecting to the internet. However, that VIP is setup to only forward 80, 443, and 8443. Does that change things?

    dolunmo2
    dolunmo2
    New Member
    July 30, 2025

    You could create virtual interfaces on the host to have multiple IPs with only a single interface, and assign your containers to those, with Traefik or nginx or just plain publishing their ports directly to the IPs of the relevant interfaces.

    Terms & ConditionsAccessibility statement