Virtual IPs to forward services on internal segmentation firewall

Question

Hi!

I want to replace my old Linux UTM-box that is working as internal segmentation firewall with a Fortigate system. As the system is providing some services

At the moment, the system is forwarding incoming traffic to other system with DNAT-rules, e.g.:

Incoming NTP-Sessions on 10.10.10.1 forward to NTP-Server 10.20.20.20

Incoming DNS-Sessions to AD-Controller-Server

Incoming SMTP-Sessions to Postfix-Server

Incoming Squid-Sessions to Squid-Server

As I do not want to change the configuration of many clients, how can I configure this?

What I tried (without success):

- Add IPv4 Virtual IP: External IP 10.10.10.1 (which is the IP of the Fortigate AND default gateway of the clients), Mapped IP 172.10.10.10, TCP 3128

- Add IPv4 Policy Allow any,any (for testing only)

What did I forget?

I think, I need a Local In Policy, but I do not find any hint on how to do that

Can you give me a hint?

Thank you and best wishes,

KPS

Kenundrum · Answer

You need a policy that specifically names the VIP as a destination to actually make it work. Just an any/any won't do it.

So if your clients are sitting on port1 and they need to be port forwarded to port2, you would create the VIP using interface port1, and then external address can be left blank (to listen on all IP addresses on the interface) or specify the IP address you want them connecting to, the mapped address would be the real server on the other side, and check the port forward box and input the ports that need to be forwarded.

Then create a new policy with a source interface of port1, destination interface port2, source address being your subnet on that side or whatever devices are allowed, destination address is the VIP (listed at the bottom typically), destination ports ideally would be a service that matches whatever ports you forwarded or all if you're still trying to figure it out.

Sign up

Login with SSO

Login to the community

Login with SSO