External access to an internal service by a known IP address

[DMN]

Hi all - need to configure access to an internal service (i.e. ssh) but only allow only 1 x external IP address so what is the best and effective way to achieve this? - thanks in advance :)

[ede_pfau]

hi, create a VIP to map your public IP address to the internal address. If your public WAN is dynamic, use ' 0.0.0.0' as a wildcard. Otherwise, use your static address. If you need your WAN address for other services also then enable port forwarding and only forward the (e.g.) ssh port 22 (or whatever). Then create a policy src IF: wan src address: the_one_external_address_allowed dst IF: internal dst address: your_VIP service: either ANY/ALL or specific e.g. ssh NAT: disable That should be all.

[DMN]

thanks for the response and will give it a go :)

[DMN]

Hi ede_pfau - I am currently forwarding port 80 ext-int so of course when I add a new VIP it states a duplicate entry exists (which is correct) so how do I get around this as I cannot enable port forwarding and have both 80 and 22 open? :)

[ede_pfau]

Of course you can create 2 VIPs from ' 0.0.0.0' on wan1 to the same internal address, using different ports for multiple services. I' ll attach screenshots from my FGT.

[ede_pfau]

and the details...

[DMN]

great and thanks for the info...makes perfect sense when I think about it :)