New Member

Solved

SSL VPN full-tunnel client not getting Fortigate's WAN IP

21 replies
267 views

I’m trying to set up a full-tunnel SSL VPN on my Fortigate 60E running 7.4.6 and for what ever reason, when connected to Forticlient if I go to a website that shows your public IP (ie- www.whatismyipaddress.com), it is showing my laptop’s local internet connection’s public IP instead of the fortigate’s WAN IP. I have tried using the ‘full-tunnel’ portal, disabling the ‘tunnel-access’ portal, changing both to ‘full tunnel’ in the SSL VPN settings and disabling both and creating a new portal which is full tunnel, but whatever I do it keeps showing up with my laptop’s local internet connection. I did some packet traces and it *seems* to be egressing the Fortigate’s WAN interface but for whatever reason it keeps showing my laptop’s internet’s public IP. I can ping devices inside the network (behind the fortigate) just fine, so I know the VPN is working. It’s a real head-scratcher. Can anyone take a look at the config (attached to this post) and tell me what is going on?

Of note, I did try disabling IPv6 tunneling and IPv6 split tunneling on the portals in the CLI in case it was trying to use IPv6 for whatever reason, but when I did, neither of them would ‘take’. Not sure if that has anything to do with it.

My connection goes: Laptop (running forticlient SSL VPN) → cellular wifi hotspot → home internet modem → fortigate (and at this point it should exit back out the home internet connection and I should be seeing a public IP when I go to www.whatismyipaddress.com)

fortigate_config_09102026-anonymized.txt

funkyliciousAnswer

SuperUser

you could try and disable ipv6 on the endpoint and see if the issue persists.

what buffles me is the fact that in the logs it clearly shows that wan1 is being used, so why it isnt it showing the public ip for whatever isp it has connected further on it.

"jack of all trades, master of none"

sjoshi

Staff

can you share the snapshot of the ssl vpn portal

Thanks, Salon

X

xen0blueAuthor

New Member

Sure, see below

sjoshi

Staff

which is your user group

Guest group or my_ra_vpn_user group?

Thanks, Salon

X

xen0blueAuthor

New Member

it is my_ra_vpn_user_group

sjoshi

Staff

Can you share the snapshot by going inside the my_full_ssl_vpn portal. I would like to check this portal config

Thanks, Salon

X

xen0blueAuthor

New Member

Sure, see below:

funkylicious

SuperUser

when you connect to the SSLVPN , if you do a in cmd route print -4 | findstr 10.212.134 , do you see a route for 0.0.0.0 somewhere ?

can you share the output of that command ?

L.E. i assume that you are using myvpnuser to connect to the SSLVPN

"jack of all trades, master of none"

X

xen0blueAuthor

New Member

Yes, I am connecting using myvpnuser and this is the output of that ‘route print -4 | findstr 10.212.134’ command:

Also, here is my ipconfig output:

funkylicious

SuperUser

if you do a, diag sniffer packet any ‘host 10.212.134.200 and icmp ‘ 4 0 l , assuming .200 is the IP assigned to FortiClient and then try to do a ping towards 8.8.8.8 , can you see traffic coming from ssl.root and is destined outbound towards the destination using wan1 or wan2 ?

"jack of all trades, master of none"

X

xen0blueAuthor

New Member

I don’t know if you saw the post above the last, but I edited it to add the IP config info

As far as the ‘diag sniffer packet’ command, here is the output:

funkylicious

SuperUser

ok, so basically this would mean that you can ping 8.8.8.8 and traffic reaches the FortiGate on a public destination that you are trying to access.

so, if you access a site like ifconfig.co , it will display your home IP and not the FGT IP, right ? if so, that’s quite strange.

"jack of all trades, master of none"

X

xen0blueAuthor

New Member

Yes, exactly. Correct. It’s being seen from my T-mobile hotspot IP and not my AT&T home internet IP

funkylicious

SuperUser

at a ipconfig /all , under Ethernet adapter Ethernet 4 i assume that you can see as being set for FortiClient adapter/interface 96.45.45.45 and 96.45.46.46

can you try and manually set them to 1.1.1.1 and 8.8.8.8 , then try and do some nslookup google.com in order to see which DNS server is used to resolve ?

"jack of all trades, master of none"

X

xen0blueAuthor

New Member

Interestingly, it is using a DNS other than the FortiDNS which is configured (probably T-mobile’s DNS server) in the Fortigate:

funkylicious

SuperUser

let’s also see a debug flow output and examine it what happens while trying to access a public site with both HTTPS ( ifconfig.co ) and ICMP ( ping 8.8.8.8 ) while connected to SSLVPN

diagnose debug reset
diagnose debug flow trace stop
diagnose debug flow filter clear
diagnose debug flow filter saddr 10.212.134.200
diagnose debug flow show function-name enable
diagnose debug flow trace start 1000
diagnose debug enable

to stop:

diagnose debug disable

diagnose debug reset

"jack of all trades, master of none"

X

xen0blueAuthor

New Member

I'm attaching my console output.

Also, well, this was interesting. When I go to ifconfig.co, it only sees my t-mobile IPv6 address but when I go to whatismyipaddress.com, it sees both my t-mobile ipv4 and ipv6 addresses

console-output-CLI-Console-(1).txt

funkylicious

SuperUser

based on these lines below, the traffic towards 151.101.129.91 ( internet ) port HTTP ( tcp/80 ) , should leave/exit on wan1 using the NAT IP of 192.168.1.143 and matching firewall rule number 16

id=65308 trace_id=104 func=print_pkt_detail line=5886 msg="vd-root:0 received a packet(proto=6, 10.212.134.200:55504->
151.101.129.91:80) tun_id=0.0.0.0 from ssl.root. flag [S], seq 1005637496, ack 0, win 65535"
id=65308 trace_id=104 func=init_ip_session_common line=6070 msg="allocate a new session-00006612"
id=65308 trace_id=104 func=vf_ip_route_input_common line=2613 msg="find a route: flag=04000000 gw-192.168.1.1 via wan1
"
id=65308 trace_id=104 func=__iprope_tree_check line=529 msg="gnum-100004, use int hash, slot=45, len=3"
id=65308 trace_id=104 func=get_new_addr line=1269 msg="find SNAT: IP-192.168.1.143(from IPPOOL), port-62601"
id=65308 trace_id=104 func=fw_forward_handler line=995 msg="Allowed by Policy-16: SNAT"
id=65308 trace_id=104 func=__ip_session_run_tuple line=3437 msg="SNAT 10.212.134.200->192.168.1.143:62601"

"jack of all trades, master of none"

X

xen0blueAuthor

New Member

So what do you think the problem is? IPv6 is taking over?

Sign up

Login with SSO

Login to the community

Login with SSO