DMZ over VLAN to VM hosted on Internal network - problem

[RBotha]

Good Day experts,

So my idea is to have a webserver (hosted as VM via Windows HyperV) on my machine on the internal network, to be accessible via VLAN from DMZ interface on our Fortigate E61 FortiOS v6.0.4 build0231 (GA).

For the moment being, I know this sounds bad, but we're limited to the infrastructure currently available until we have this cloud hosted. We have the above mentioned fortigate unit and an ubiquity unifi managed switch between the internet and my local machine. My machine also has 2 NICs (one ethernet, the other Wifi)

I want to make said webserver accessible via the fortigate's DMZ port (on VLAN 20), which then goes to the same unifi switch as mentioned above (again, over VLAN 20) then to my local machine's ethernet NIC which is used exclusively by the VM for traffic.

These are the steps I have already taken:

[ol]

Created a virtual interface on my internal (Interface 1: 192.168.1.1) port addressed 192.168.2.1 255.255.255.0.

Created a Virtual IP (name: DMZ_VIP ext id: 11.22.33.44 mapped internal IP 192.168.2.10 interface: DMZ_VLAN) (with PING and HTTPS ports forwarded).

Created a policy with incoming interface: wan, outgoing: DMZ_VLAN, source: all, destination: IPRANGE 192.168.2.10 (since even though I have created a VIP, I an unable to to list it as the destination for some reason? I read that one has to disable central NAT or something?), NAT: off.

Created a policy with incoming interface: DMZ_VLAN, outgoing: wan, source: all (again, I can't specify my VIP), destination: all, NAT: off)

Created a VLAN 20 on the unify switch.

Setup HyperV's virtual switch to use my local machine's ethernet port with VLAN 20 and assigned it to my VM.

Set a static IP for the VM (192.168.2.10) with gateway IP 192.168.2.1[/ol]

Here are my results (as commands executed from the webserver at 192.168.2.10)

[ol]

I can ping the fortigate DMZ interface (DMZ_VLAN) at 192.168.2.1 - GOOD

I cannot ping anything else on my internal network since only the machine and DMZ_VLAN use VLAN 20 - GOOD

I cannot ping an outside service like google's DNS service (my go-to when testing internet connectivity) - BAD

I cannot reach my webserver's hosted IIS applications from the internet using the URL: https://11.22.33.44 - BAD

Nothing can ping the webserver from the internal network - GOOD.[/ol]

I still need to achieve the listed items above (specified as "BAD") (i.e. I need to hit the webserver from the internet, I neet the webserver to have internet access)

I hope I've explained with as much detail as possible. I've read up again and again but never quite see an article that addresses creating a VLAN on the DMZ port to a VM that's on the local internal network.

My knowledge and experience with networking is somewhat limited ( I mean I know ICMP atleast) and a few different things but I've been scouring the web with no luck as such on how to do this. 

I have followed the cookbooks to  setup a DMZ port but still run into the problem as mentioned above (I cannot set the policy's destination to a VIP, to allow wan traffic to my webserver). I have upgraded my firmware since but with no luck.

Please also see the screenshots of my actions attached. 

[rwpatterson · Accepted solution]

rikus@theaccountingteam.co.za wrote:
[ol]

I cannot ping an outside service like google's DNS service (my go-to when testing internet connectivity) - BAD

I cannot reach my webserver's hosted IIS applications from the internet using the URL: https://11.22.33.44 - BAD

[/ol]

1) Do you have a policy from VLAN 20 to the Internet with NAT enabled?

2) Do you have a Virtual IP (VIP) defined and used as the target in a policy from the Internet to VLAN 20?

[RBotha]

More Screenshots

[RBotha]

rikus@theaccountingteam.co.za wrote:

More Screenshots

Hi Bob,

Thanks for your reply. Well yes, I do have an internet facing policy for my DMZ, but forgot to turn on NAT. Turned it on and looks good! Thanks!

As for your second point, yes I do have a VIP created but my appliance does not allow me to set this VIP as the target (or destination) for this policy. So I tried creating a range (since I could atleast list it) but that' doesn't work either. I've read that people had this problem on several different occasions but I can't seem to find a fix for it. Upgrading firmware didn't allow me to set it either. Any advice?

If you see the attached screenshot, I currently have an IPRange assigned to as te target, because my DMZ_VIP is not listed under the addresses column. I have no idea why It doesn't show up. it is definitely created.

[rwpatterson · Accepted solution]

When you define the VIP, make sure you choose the correct outside facing interface or it will not display in the drop down.

[RBotha]

Bob, you're a life saver! The changes to settings you suggested are perfect!

I made the error on thinking that when I specify the interface in the VIP, that it should be the VLAN. I changed this to reflect the wan interface and it works now! It also makes sense. 

Thanks a bunch!

[rwpatterson]

You are welcome. Glad I could help.

[RBotha]

Bob, 

You won't believe this but now suddenly, our discussions rendered my webserver unreachable. I've actually completely redone the above and I still cannot reach my server. I keep hitting my actual firewall interface. Just a day ago I was able to go beyond it (while still leaving the admin management interface active on the wan interface). Can you suggest any reasons as to how I might go about checking the connection? I don't want to hit my publicly facing firewall (and I don't mean disabling the management interface on wan interface). 

Any suggestions on packet tracing or log checking is also greatly appreciated.

[rwpatterson · Accepted solution]

rikus@theaccountingteam.co.za wrote:
[ol]

I cannot ping an outside service like google's DNS service (my go-to when testing internet connectivity) - BAD

I cannot reach my webserver's hosted IIS applications from the internet using the URL: https://11.22.33.44 - BAD

[/ol]

1) Do you have a policy from VLAN 20 to the Internet with NAT enabled?

2) Do you have a Virtual IP (VIP) defined and used as the target in a policy from the Internet to VLAN 20?