DMZ or IP Whitelisting

[k1rusty]

Hi!

I have an internal server and our vendor needs access to it on specific port. Its not ssh/RDP, some generic database port.

Normally any server with access from outside should be placed in DMZ. This is special case as we cannot move the server to DMZ. Do you think IP Whitelisting can provide the similar security.

Reverse proxy is also a solution but I not sure if it will create any performance issue or it will work fine.

So that leaves me to IP whitelisting in first place. Do you think it will provide enough security?

Thanks

[eowusu]

Whitelisting just vendor's IP address as source in a firewall policy should be sufficient in providing security in the access of the internal server. Create a service port for the database port if it does not exist on the firewall. A vip object mapping your external IP(WAN) to the internal server and port forwarding enabled for the database port. Apply the VIP object in the firewall policy as destination in the firewall policy

[AEK]

Hello

In addition to eowusu's suggestion, you need to add two firewall policies.

1. Fist one is to allow vendor's public IP to access your new VIP
2. Second one, below the first policy, to deny any other traffic from WAN to your new VIP

You may also add security profiles (IPS, AV and so) to the first policy.

Doing that way should be quite secure.

[mpeddalla]

Hello  @k1rusty ,

Thank you for contacting the Fortinet Forum portal.

As explained by my colleague Eric and AEK can consider those processes please refer below article for procedure reference

1. create a custom port on the firewall  

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-custom-service-port-in-Forti...

2. Add service by creating an external public ip VIP virtual IP for Natting to a private address.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-Virtual-IPs-to-configure-port-forwar...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configurati...

-Additionally to protect the server from unwanted traffic on public IP as well, add deny policy other than specified services to that VIP and make sure to enable match-vip on firewall policy from CLI 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Firewall-does-not-block-incoming-WAN-to-LA...

Best regards,

Manasa.

If you feel the above steps helped to resolve the issue mark the reply as solved so that other customers can get it easily while searching on similar scenarios.

[vbandha]

@k1rusty 

Another option you can consider is using SSL VPN or IP Sec VPN. That would provide secure connection to the fortigate and not expose anything directly to internet. 

The option for whitelisting is also a good option, whichever is better suited for your environment. 

Regards, 

Varun