Can't reach external remote server on specific port

[R1chou]

Hello,

I'm trying to connect thru MSTSC to a remote server on port 3432 (I don't manage this server or the firewall)

I have a rule that's allow me to access all ports (from lan to wan)

When I use policy lookup it shows me that rule.

I tried to create a specific rule for this specific server and specific port but it doesn't change anything.

When I try to reach this server from my personnal connection I can connect to it.

How could I troubleshoot to be sure that everything is ok on my site ?

Regards,

[Patel]

Hello,

Looking at what you mentioned, it looks like you are already allowing the traffic to flow through the FortiGate.

If the server is on the Internet, then please check if you have NAT enabled on the policy.

Furthermore, you can use the following commands to sniff the traffic on the FortiGate and confirm if the FortiGate is allowing the traffic and NATing it properly or not.

diagnose sniffer packet any "host <destination IP> and port 3432" 4 0 l

If everything looks good on the FortiGate side, then it would be a nice idea to check sniff the traffic on the destination side and see if they are receiving it or not.

Regards,

Kavin

[R1chou]

Hi Kavin,

Yes, Nat is enabled.

Just tried your commande, here is the result (it tried 4 times and then stopped) :

# diagnose sniffer packet any "host X.X.X.X and port 3432" 4 0 l
interfaces=[any]
filters=[host X.X.X.X and port 3432]
2021-06-25 08:22:58.218131 port5 in Y.Y.Y.Y.54804 -> X.X.X.X.3432: syn 3033647415 
2021-06-25 08:22:58.218316 wan1 out Z.Z.Z.Z.54804 -> X.X.X.X.3432: syn 3033647415 
2021-06-25 08:22:59.233239 port5 in Y.Y.Y.Y.54804 -> X.X.X.X.3432: syn 3033647415 
2021-06-25 08:22:59.233278 wan1 out Z.Z.Z.Z.54804 -> X.X.X.X.3432: syn 3033647415 

X.X.X.X = remote server

Y.Y.Y.Y = my private ip address

Z.Z.Z.Z = ours public ip address

[Patel]

Hello,

> 2021-06-25 08:22:58.218316 wan1 out Z.Z.Z.Z.54804 -> X.X.X.X.3432: syn 3033647415

Looking at this output, it looks like the SYN packet was sent out using the correct public IP address.

I would recommend to check the traffic on the other side or with your ISP as I don't think FortiGate is causing an issue with the traffic.

Regards,

Kavin