Technical Tip : How to block access to a certain application on the same server behind the FortiGate from the Internet while allowing access to the others

[auppal]

Description

This article describes how to block a certain application on the same server behind the FortiGate from the internet while allowing access to the others.

Scope

FortiGate.

Topology:

Three applications are hosted on the same server behind the FortiGate. Access to Application 1 from the Internet needs to be blocked while Application 2 and Application 3 can still be accessed from the Internet.

The following are the applications on the same server:

• Application 1: https://example.com/status/prv01  -> Not accessible from the Internet.
• Application 2: https://example.com/status/pub01 -> Accessible from the Internet.
• Application 3: https://example.com/status/pub02 -> Accessible from the Internet.

This server is hosted behind the FortiGate using a virtual server configuration.

Prerequisites:

Virtual server or Virtual IP (VIP) is configured on the FortiGate.

Solution

1. Configure a Web Filter security profile with only static URL filtering to block access to certain URLs. For example: *example.com/status/prv* 
   
   

2. Configure an inbound firewall policy to allow traffic to the configured virtual server or VIP in Proxy-based inspection mode.
3. Apply the above Web Filter security profile to the new firewall policy.
4. Apply the SSL inspection profile with Protecting SSL Server enabled and select the required server certificate in it: Protecting an SSL server
5. Apply other security profiles such as WAF or AV  as per the requirement.
6. The following is an example of the firewall policy for this task:

config firewall policy
    edit 1
        set name "**reverse-proxy**"
        set srcintf "wan"
        set dstintf "internal"
        set action accept
        set srcaddr "all"
        set dstaddr "reverse-proxy-testing" <----- Virtual server.
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set inspection-mode proxy
        set ssl-ssh-profile "_protect_server"
        set webfilter-profile "_inbound"
        set waf-profile "_strict_waf"
    next
end

Result:
If a user tries to access Application 1, it will get blocked due to the configured URL static filter:

However, if the user tries to access either Application 2 or Application 3, it will be successful.