Central NAT - DNAT configuration

[DamianLozano]

Hello,

I just installed a new fortigate and for first time enabled "central NAT" from cli 

I created a SNAT rule for each outgoing Internet connection and I think these rules are working because I can browse Internet

Now I want to forward the port TCP 81 to 10.1.1.234 because I need to access there from Internet.

I created the following "DNAT & Virtual IP":

Interface: lan (I dont know if this should be the source or destination interface, but I tested with each with no luck)

Source Interface Flter: disabled

External IP Address/Range: PublicIP

Mapped IP Address/Range: 10.1.1.234

Optional Filters: disabled

Port Forwarding: enabled

Protocol: TCP

External Service Port: 81

Map to Port: 81

I can connect from inside with "telnet 10.1.1.234 81" but I can not connect from outside with "telnet publicIP 81", so the "DNAT & Virtual IP" is not working

What is wrong?

Thanks in advance.

Regards,

Damián

[poundy]

do you have a policy to permit inbound connection to the VIP ? I suspect that's all you're missing...

The next thing I'll point you to is "diag debug flow". For example have a look at this page for inspiration https://marktugbo.com/2017/07/04/tools-flow-trace-in-fortigate/ but a simplistic version for you would be something like:

diag debug disable

diag debug flow filter daddr 10.1.1.234

diag debug flow filter port 81

diag debug flow show function-name enable

diag debug flow trace start 10

diag debug enable

... and then look at what info you get from there.

[DamianLozano]

Hello people!

You were right, the traffic is being blocked by the implicit policy:

id=20085 trace_id=1 func=print_pkt_detail line=5573 msg="vd-root:0 received a packet(proto=6, SRCpublicIP:53495->WAN1IP:81) from wan. flag , seq 4175373843, ack 0, win 64240" id=20085 trace_id=1 func=init_ip_session_common line=5744 msg="allocate a new session-01b345f2" id=20085 trace_id=1 func=vf_ip_route_input_common line=2591 msg="find a route: flag=80000000 gw-WAN1IP via root" id=20085 trace_id=1 func=fw_local_in_handler line=412 msg="iprope_in_check() check failed on policy 0, drop"

The problem is that I cannot select the new "DNAT & Virtual IP" in a policy, I just added temporarily a policy to allow everything from wan to lan with no luck

I tried it in many ways with no luck

Fortigate should have better documentation about its features

Do you know any document about how to forward a port from skratch?

Can you explain this to me?

I assisted a NSE4 course but we never seen this

Thanks in advance

Regards,

Damián

[DamianLozano]

I just found the following in the Lab guide of the NSE4:

"You can't select VIPs previously created in a firewall policy as a destination address.

As soon as a VIP object is created, FortiGate automatically creates a rule in the kernel for DNAT to occur"

The guide asked me to enable a rule but the lab stopped being available when the curse ended

Image attached

Regards

[DamianLozano]

No one knows Central NAT?

Regards

Damián

[poundy]

i think nobody cared when you said you were doing this all as part of a course and you have no access to a lab, and when the lab notes explicitly said you can't do what you tried to do. 

[DamianLozano]

This is not as part of a course, this is an issue in a fortigate that I configured for a customer, which is in production right now

I did the NSE4 course before and there I learn that there is something called "Central NAT" but they dont explain this well enought or I missed something.

I still need to forward some port but I could not find anything usefull in the course pdfs

Regards,

Damián

[poundy]

so then what is your problem exactly ? You need a policy permitting port81 traffic. 

Take this out of theoretical. Show us the configuration commands you have in place and what you have tried??!

[DamianLozano]

Hello,

I cannot forward port TCP 81, this is the problem

Temporarily added a rule to allow everything from WAN to LAN but nothing changed

The dst-nat is the following:

config firewall vip edit "Example" set uuid 71b50130-e166-51ea-3826-075742213cf8 set comment "Ejemplo de publicacion de puerto" set extip 179.60.208.66 set extintf "any" set portforward enable set color 18 set mappedip "10.1.1.234" set extport 81 set mappedport 81 next end

Regards,

Damian

[emnoc]

Can we see the fw-policy that uses that VIP? Also do you have any other rules that are deny? You might need to set match vip enable.

https://kb.fortinet.com/kb/documentLink.do?externalID=FD33338

Also do not forget rule order-seq, but since your hitting implicit deny, I don't think that is the issue.

And lastly, if the rule has a DNAT-VIP, make sure you do not enable nat in the policy.

Ken Felix