Allow One IP to Remotely Browse through Site-to-Site

[dholton912]

Hey everyone!

I have a site-to-site VPN between two locations. Is there a way I can pass only one IP address through for remote browsing. For example, I have a subnet of 10.0.0.0/24 on FW A that can access all internal resources on FW B (example subnet of 10.1.1.0/24). I have one workstation (10.0.0.50) on FW A that would need to access the internet through FW B. The rest of the network would still access the internet through FW A. I tried using this KB https://community.fortinet.com/t5/FortiGate/Technical-Tip-Remote-browsing-over-IPSec-VPN-tunnel/ta-p... but am unable to get what I need to work. Any help with this would be greatly appreciated!

[AEK]

Hello

Did you try with policy route?

[mpeddalla]

Hello  @dholton912 ,

Thank you for contacting the Fortinet Forum portal.

-You can create a policy route on firewall B with source 10.0.0.50 to destination 0.0.0.0/0.0.0.0 interface should be site to site vpn tunnel.

-On the remote site create a firewall policy or make sure the traffic passes via the wan interface from that source.

article for policy route 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-the-firewall-Policy-Routes/ta-...

Best regards,

Manasa.

If you feel the above steps helped to resolve the issue mark the reply as solved so that other customers can get it easily while searching on similar scenarios.

[dholton912]

So when creating the policy route, do I create it on FW B or A? 

[dholton912]

Also how do I prevent 10.0.0.50 from using FW A to get to the internet before passing to FW B?

[dholton912]

Also, for the policy route on FW B, should the incoming interface be the site-to-site and the outgoing interface be my wan interface or something different?

[hbac]

Hi @dholton912,

Since 10.0.0.50 is behind FW A, you need to create a policy route on FW A and not FW B. On FW B, you need a firewall policy to allow traffic from the IPsec tunnel to the Internet with source=10.0.0.50 if no NAT is involved. 

Regards, 

[mle2802]

Hi @dholton912,

So policy route on FW A with source of 10.0.0.50/32 and destination of 0.0.0.0. On FwB, you will also need policy from tunnel interface to wan with same source as policy route on FWA. 

[mle2802]

Hi @dholton912,

Also please make sure there is policy from where 10.0.0.50 site to tunnel interface and 10.0.0.50 is included in P2 to allow through the tunnel.

[dholton912]

So on the FW A, I have a policy route that has the incoming interface set as internal with the source as 10.0.0.50 and the destination as 0.0.0.0/0.0.0.0. The action is set to forward traffic to outgoing interface of site to site VPN and a gateway address of 0.0.0.0. 

I have the 10.0.0.50 in the phase 2 of the site-to-site with a destination of 0.0.0.0 and the inverse on the remote FW where internet should pass through. I also have a policy on that FW that allows traffic from the S2S VPN with 10.0.0.50 to access the WAN interface. 

The issue I'm still seeing is when 10.0.0.50 goes to access the 10.1.1.0/24 network it is successful. But if I go to access any other IP or URL, the traffic seemingly goes nowhere.