Static Route, LAN unable to access internet

---

@sgClarence wrote:

 

Port 1: ISP gateway (isp.xx.xx.229/30)

Port 2: WAN Router (inet.xx.xx.81/29)

Port 3: 192.168.1.99/24 with DHCP enabled

 

Static Route: 0.0.0.0/0.0.0.0 using gateway isp.229 at port 1

Policy IPv4: Port 1 to Port 2(downstream), Port 2 to Port 1(upstream) and Port 3 to Port 2(LAN to internet)

 

So static Route goes to Port1. Your Lan to Intertnet Policy goes to port2. That doesn't seem to match.

Inet Traffic directly from FGT via Port1 works as you wrote so your default route is good. 

So route says trafic from anywhere to inet has to hit port1 but there is no policy matching that.

I'd guess that if you did a flow trace on cli it would have stated with "denied by forward policy check (policy #0)" or similar message.

You always have to keep in mind that the first thing that is looked at when a packet comes in is always the routing table because the route gives the way. After that the FGT looks for a matching policy and if there is no explicite one the traffic is always matched by policy #0 which is the implicite "deny everything to everything" policy.

common practice is to connect your isp to the wan port(s) of your FGT.

Then have one or more default route(s) or use sdwan instead for loadbalancing if needed.

then create some policy.

You can imagine that basicially in this way somehow:

If you want to go from A to B you have to look at your map if there is a way from A to B.

Then you have to find out if you are allowed to use that way and if there are limitations.

What is the map for you is the routing table for your FGT.

And the policies rule if the packet may use that way and with which limitations.

The default route specifies where packages should go that hava destination that is not matched by any other route. Before this always comes routes that derive from interfaces (connected route) and static routes (in this order). So if there is no static or connected route the packet will hit the default route. And in your case the default route states the packet has to go to port1.

So next step the FGT does is to look at its policy package to find a policy matching source interface Port3 and source address Lan and destination interface port1 and destination "any".

Since there is no such explicite policy it will match policy #0 which is the implicite deny policy that matches anything that has not been matched by any other policy before. This results in the packet being denied.

So you have to have - accoarding to your default route - a policy from Port3 to Port1 (LAN to internet) with LAN Subnet as source and "any" as destination and destination NAT enabled.

Can you rule out NAT? The firewall policy that goes from LAN to internet should have NAT enabled.