Skip to main content
AMAK
AMAK
Visitor III
March 12, 2023
Question

Virtual IP address to connecting from internal

  • March 12, 2023
  • 3 replies
  • 3212 views

I have configured Virtual IP address from my website with port forwarding"

Interface: WAN1

Static NAT type

Local IP: 192.168.1.54

Public IP: XX.XXX.XXX.XX

Port Forwarding External 80 Map to IPv4 Port 84

The Policy for this Virtual IP:-

Incoming Interface: WAN1

Outgoing Interface: internal

Source: WAN2_int (Subnet 0.0.0.0/0 Interface:wan2)

Destiantion: Virtual IP (above)

Service: All_TCP

NAT: enabled

IP Pool configuration: Use Outgoing Interface Address

 

I cannot resolve the domain name to browse the website, nor can I browse the website with a Public IP address. All my hosting services for website and exchange emails didn't work.

 

Am I missing some routing policies or some Internat to WAN policies? 

Totally lost

 

3 replies

asengar
Staff
asengar
Staff
March 12, 2023

Hi Amak

 

Can you try giving the service as ALL in the policy, and also clarify the line in the policy you defined  [Source: WAN2_int (Subnet 0.0.0.0/0 Interface:wan2)].

Also verify are you able to access internally on port 84 or not

 

Thanks

    AMAK
    AMAKAuthor
    Visitor III
    March 13, 2023

    WAN2_int is an Address to use the WAN2 interface only.

    config firewall address edit "WAN2_int" set associated-interface "wan2" next end

     

    aionescu
    Staff
    aionescu
    Staff
    March 13, 2023

    Hi @AMAK 

    To have better visibility on how the traffic is handled  can you, please, perform a debug of the traffic flow?

     

    diagnose debug reset

    diagnose debug flow filter addr x.x.x.x <----- where x.x.x.x is the source of the traffic.

    diagnose debug flow trace start 100

    diagnose debug enable

     

    Is routing properly configured, are you able to reach 192.168.1.54 from the FortiGate?

      AMAK
      AMAKAuthor
      Visitor III
      March 14, 2023

       

      Firewall60F # diag debug flow trace  start 50 Firewall60F # diag debug  enable Firewall60F # id=65308 trace_id=1 func=print_pkt_detail line=5868 msg="vd-root:0 received a packet(proto=6, 192.168.1.25:52645->XX.XXX.XXX.XX:80) tun_id=0.0.0.0 from internal. flag [S], seq 368941642, ack 0, win 64240" id=65308 trace_id=1 func=init_ip_session_common line=6049 msg="allocate a new session-000301a2, tun_id=0.0.0.0" id=65308 trace_id=1 func=get_new_addr line=1228 msg="find DNAT: IP-192.168.1.54, port-84" id=65308 trace_id=1 func=fw_pre_route_handler line=176 msg="VIP-192.168.1.54:84, outdev-unknown" id=65308 trace_id=1 func=__ip_session_run_tuple line=3498 msg="DNAT XX.XXX.XXX.XX:80->192.168.1.54:84" id=65308 trace_id=1 func=vf_ip_route_input_common line=2605 msg="find a route: flag=04000000 gw-192.168.1.54 via internal" id=65308 trace_id=1 func=__iprope_tree_check line=524 msg="gnum-100004, use int hash, slot=79, len=2" id=65308 trace_id=1 func=fw_forward_handler line=757 msg="Denied by forward policy check (policy 0)" id=65308 trace_id=2 func=print_pkt_detail line=5868 msg="vd-root:0 received a packet(proto=6, 192.168.1.25:52646->XX.XXX.XXX.XX:80) tun_id =0.0.0.0 from internal. flag [S], seq 3094431630, ack 0, win 64240"

       

       

      aionescu
      Staff
      aionescu
      Staff
      March 14, 2023

      Hi, the output shows that the traffic is dropped because there is no policy to allow it.

      As per your first comment the traffic is expected to come from WAN but in the provided output it comes from "internal". Please check if the policy is correctly configured.

        TerenceBC
        TerenceBC
        New Member
        October 19, 2023

        Any solution to this?

        Terms & ConditionsAccessibility statement