New Member

Question

SSH not answering through VIP

Forum|Forum|1 year ago
November 21, 2024
4 replies
2819 views

Hi guys,

i got some problem and i cant figure this out.

I have a virtual machine on server which will be a mail server in future. Ive created a VIP on Forti that is internal address mapped to public. It pings and is visible from outside but services are not responding at public address f.e. SSH port 25.I also added even port forwarding for all ports 1-65535 and it still doesnt answer. Anyone got an idea what to do? I can log in to machine from our internal network through SSH but i cant do the same when i try to log in to public address

FortiGate

pminarik

Staff

I wouldn't be surprised if an ISP blocked TCP/25.

Have you checked whether the packet reaches the FortiGate at all?

> diag sniffer packet <wan-intf-name> "host <VIP external IP> and port 25" 4 0 a

=> test

CTRL+C to stop

dingjerry_FTNT

Staff

Hi @pprx ,

We need to check whether the traffic on port 25 is arriving on FGT first. Please run this command to confirm:

diag sniffer packet any 'host <client public IP> and port 25' 4

dingjerry_FTNT

Staff

And you can get your client public IP via https://www.whatismyip.com/

Toshi_Esumi

SuperUser

You meant "SSH TCP port 22", right? TCP 25 is SMTP.

Toshi

dingjerry_FTNT

Staff

I think that he is going to setup a mail server on port 25, so he is testing with port 25.

@pprx , please test with "telnet", not "SSH".

Toshi_Esumi

SuperUser

I thought he was testing with SSH/TCP 22 although his final objective is to make SMTP server work behind the FGT. That's a reasonable test if he allowed just all ports to be forwarded to the server.
If you have doubt about your VIP config, the first thing I would do is to sniff on the FGT's outgoing interface if the SSH access from outside is actually forwarded to the target server.
If it's forwarded at the FGT as intended, the next thing is to run Wireshark on the server if it's receiving those packets.

By that time, you're probably clear where the problem resides and what's going on to fix it.
If you still have doubt about your VIP config, you can share the config under "config firewall vip" with us after masking your real public IP.

Toshi

pprxAuthor

New Member

next
edit "Serwer_Pocztowy"
set uuid 396ee918-a655-51ef-38e6-1432cc4067de
set extip xxx.xxx.xxx.xxx
set mappedip "xxx.xxx.xxx.xxx"
set extintf "wan1"
set portforward enable
set extport 12322
set mappedport 22
next
edit "Serwer_Pocztowy2"
set uuid 12ab179a-a7e8-51ef-cc4d-24bdab69d183
set extip xxx.xxx.xxx.xxx
set mappedip "xxx.xxx.xxx.xxx"
set extintf "wan1"
set portforward enable
set extport 1-65535
set mappedport 1-65535
set portmapping-type m-to-n
next
end

@Toshi_EsumiYes i meant SSH 22 port cause i need it to give it to my coworkers for installation on server, sorry

But I think problem will be the same with other ports when mail server will have to communite to internet through smpt and so on.

Here You have my 2 tries with it. On one i tried to Many to Many and SSH still is silent, on second i tried to map One to One, ofc it doesnt work.

diag sniffer packet any 'host x and port 22' 4
interfaces=[any]
filters=[host x and port 22]
400.716655 wan1 in x -> x.22: syn 3176200376
401.715800 wan1 in x -> x.22: syn 3176200376
403.714573 wan1 in x -> x.22: syn 3176200376
407.774874 wan1 in x -> x.22: syn 3176200376
415.784499 wan1 in x -> x.22: syn 3176200376
460.066594 wan1 in x -> x.22: syn 1068178477
461.102649 wan1 in x -> x.22: syn 1068178477
463.142497 wan1 in x -> x.22: syn 1068178477
467.084320 wan1 in x -> x.22: syn 1068178477
475.092478 wan1 in x -> x.22: syn 1068178477

Result of diag sniffer

funkylicious

SuperUser

Hi,

Can you try and activate NAT on the firewall policy ( WAN to LAN ) and/or disable firewall locally on the destination which you are trying to reach?

It seems that the destination is not returning any traffic which could mean that either it's default route isn't thru the FW ( NAT will solve the issue ) or the access is blocked locally on the server.

"jack of all trades, master of none"

Sign up

Login with SSO

Login to the community

Login with SSO