Allow One IP to Remotely Browse through Site-to-Site

[dholton912]

Hey everyone!

I have a site-to-site VPN between two locations. Is there a way I can pass only one IP address through for remote browsing. For example, I have a subnet of 10.0.0.0/24 on FW A that can access all internal resources on FW B (example subnet of 10.1.1.0/24). I have one workstation (10.0.0.50) on FW A that would need to access the internet through FW B. The rest of the network would still access the internet through FW A. I tried using this KB https://community.fortinet.com/t5/FortiGate/Technical-Tip-Remote-browsing-over-IPSec-VPN-tunnel/ta-p... but am unable to get what I need to work. Any help with this would be greatly appreciated!

[hbac]

@dholton912,

You can have 2 static routes with the same distance. Just give your local Internet route a higher priority so that all other users will only use the local Internet route. 

Regards, 

[dholton912]

That fixed it! Thank you and @mle2802 so much for your help in this matter!!

[AEK]

You create it on firewall A with source 10.0.0.50.

Try use policy routes for exceptions only.

If you read the tech tip provided by @mpeddalla you will take real advantage of the policy routes.