Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
k1rusty
New Contributor

DMZ or IP Whitelisting

Hi!

I have an internal server and our vendor needs access to it on specific port. Its not ssh/RDP, some generic database port.

Normally any server with access from outside should be placed in DMZ. This is special case as we cannot move the server to DMZ. Do you think IP Whitelisting can provide the similar security.

Reverse proxy is also a solution but I not sure if it will create any performance issue or it will work fine.

So that leaves me to IP whitelisting in first place. Do you think it will provide enough security?

Thanks

omegle xender
4 REPLIES 4
eowusu
Staff
Staff

Whitelisting just vendor's IP address as source in a firewall policy should be sufficient in providing security in the access of the internal server. Create a service port for the database port if it does not exist on the firewall. A vip object mapping your external IP(WAN) to the internal server and port forwarding enabled for the database port. Apply the VIP object in the firewall policy as destination in the firewall policy

AEK
Honored Contributor

Hello

In addition to eowusu's suggestion, you need to add two firewall policies.

  1. Fist one is to allow vendor's public IP to access your new VIP
  2. Second one, below the first policy, to deny any other traffic from WAN to your new VIP

You may also add security profiles (IPS, AV and so) to the first policy.

Doing that way should be quite secure.

AEK
AEK
mpeddalla
Staff
Staff

Hello  @k1rusty ,

 

Thank you for contacting the Fortinet Forum portal.

As explained by my colleague Eric and AEK can consider those processes please refer below article for procedure reference

1. create a custom port on the firewall  

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-custom-service-port-in-Forti...

2. Add service by creating an external public ip VIP virtual IP for Natting to a private address.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-Virtual-IPs-to-configure-port-forwar...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configurati...

 

-Additionally to protect the server from unwanted traffic on public IP as well, add deny policy other than specified services to that VIP and make sure to enable match-vip on firewall policy from CLI 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Firewall-does-not-block-incoming-WAN-to-LA...

 

Best regards,

Manasa.

 

If you feel the above steps helped to resolve the issue mark the reply as solved so that other customers can get it easily while searching on similar scenarios.

vbandha
Staff
Staff

@k1rusty 

Another option you can consider is using SSL VPN or IP Sec VPN. That would provide secure connection to the fortigate and not expose anything directly to internet. 

 

The option for whitelisting is also a good option, whichever is better suited for your environment. 

 

Regards, 

Varun

 

Labels
Top Kudoed Authors