FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.


Description This article describes port forwarding using FortiGate Virtual IPs.

All FortiGate units.

FortiOS 5.0, 5.2 and 5.4

Steps or Commands

Add Virtual IPs to enable port forwarding:


To forward TCP or UDP ports received by your FortiGate unit external interface to an internal server, you need to follow two steps.

- Add a Virtual IP enabled with Port Forwarding.

- Add a firewall policy with a virtual IP.


This example describes how to configure port forwarding to allow access to an internal Windows Server PC with the Remote access protocol which uses the default port of 3389.

To add a virtual IP that forwards RDP packets


1) In 5.0, Go to Firewall Objects > Virtual IPs > Virtual IPs.


2) In 5.2, Go to Policy & Objects > Objects > Virtual IPs.


3) In 5.4, Go to Policy & Objects > Virtual IPs.

3.1) Select Create New.

3.2) Add a name for the virtual IP.

3.3) Select the External Interface. This will typically be the interface that connects your FortiGate unit to the Internet.

3.4) Set the External IP Address. The following can be used:

- The FortiGate unit public IP.

- If there is a cable or DSL connection with a dynamic IP, you can use

- If the ISP provides a block of IPs that route to your FortiGate unit external interface, you can add one of these IPs here.


4) Set the Mapped IP Address to the internal IP address of the Windows Server PC.


5) Select Port Forwarding.


6) Set protocol to TCP.


7) Set External Service Port and Map to Port. For this example, the RDP service uses port 3389. Set both External service port and Map to Port to 3389.


8 ) Select OK.



Now all that’s left is to define a firewall policy that accepts RDP traffic from the Internet and forwards it to the internal Windows Server PC.

To add a firewall policy with a virtual IP.


1) In 5.0, Go to Policy > Policy.
In 5.2, Go to Policy & Objects > Policy > IPv4.
In 5.4, Go to Policy & Objects > IPv4 Policy.


2) Select Create New.


3) Set Source Interface to the WAN/Internet interface.


4) Set Source Addresses to all.


5) Set Destination Interface to internal.


6) Set Destination Address to the name of the virtual IP.


7) Usually, the remainder of the options in this firewall policy does not need to be changed. For example, Service can remain ANY, because the virtual IP only forwards packets using port 3389.


8 ) Select OK.