Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Allow One IP to Remotely Browse through Site-to-Site

Hey everyone!


I have a site-to-site VPN between two locations. Is there a way I can pass only one IP address through for remote browsing. For example, I have a subnet of on FW A that can access all internal resources on FW B (example subnet of I have one workstation ( on FW A that would need to access the internet through FW B. The rest of the network would still access the internet through FW A. I tried using this KB but am unable to get what I need to work. Any help with this would be greatly appreciated!

1 Solution



I believe your default route is pointing to wan2 which is why it doesn't match the policy route. You will need another static route and point it to the IPSec tunnel. You can create a static route for for testing and point it to the IPSec tunnel. After that, run the debug flow again. 



View solution in original post


Yes, other devices can still access the other LAN across the S2S tunnel.


Can you try to assign interface IP for tunnel interface on both end and then use the IP of the other side as a gateway for the policy route? 


What should the interface IP be at both sides? The public IP of the firewall or something different?


You can use any internal IP as long as it is not duplicate with any local address on FortiGate.


Does it need to be within the same subnet?


Same subnet with what? You use such as and


Alright that has been changed.


Can you try the command 
dia ip proute match interface 6 443 443

This is the syntax # dia ip proute match <destination ip> <source ip> <incoming interface> <proto> <destination port number>

Then you can try to ping again with debug flow again



I received

command parse error before 'proute'
Command fail. Return code -61


Then just try to ping with debug flow to see if policy routing hitting now



Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors