Skip to main content
wws
wws
New Member
April 1, 2025
Solved

Webui access from specific internet address

  • April 1, 2025
  • 1 reply
  • 1392 views

New FortiGate admin here. I'm looking to enable web-admin on the WAN ports, but only allow access from specific IP addresses. I've created the address objects, but am not seeing how to configure a firewall policy. There would (obviously) be no outgoing interface.

I can see a couple of suggestions coming, so to avoid those...

  • I'd rather not have to use a VPN just for remote admin access.
  • Also, configuring "trusted hosts" for specific users still exposes the admin ports to the entire internet, which is an all-around bad idea.

So, a firewall policy should be the way to go...

Any help would be appreciated!

Best answer by wws

Local policies look powerful.  But, I went with something a little simpler:  a Virtual IP + Firewall Policy.  The virtual IP forwards the webui port through to the firewall's internal address, and the firewall policy controls who has access.

1 reply

AEK
SuperUser
AEK
SuperUser
April 1, 2025

You are probably looking for local-in policy.

https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/363127/local-in-policy

AEK
wws
wwsAuthorAnswer
New Member
April 2, 2025

Local policies look powerful.  But, I went with something a little simpler:  a Virtual IP + Firewall Policy.  The virtual IP forwards the webui port through to the firewall's internal address, and the firewall policy controls who has access.

    AEK
    SuperUser
    AEK
    SuperUser
    April 2, 2025

    I didn't test it because I find it more secure to avoid publish the WebUI directly on WAN. But trough VPN is much more secure. However I find your method a good idea for hardening access to WebUI from WAN.

    BTW there is another approach with loopback interface, explained by Yurisk in this article. He did it for SSL VPN but it should also work for WebUI.

    https://yurisk.info/2023/03/21/fortigate-vpn-ssl-hardening-guide/#_move_vpn_ssl_listening_interface_to_a_loopback_interface

    AEK
    Terms & ConditionsAccessibility statement