I have FortiWiFi 60E
I had to open port 80 and port 443 to support a web page
I am getting daily attacks on port 80 and need to know the steps to protect it.
On my server IIS I am forwarding port 80 -> 443 and is working fine
The attacks continue to happened port 80 and FortiWIFI 60E allows incoming IP addresses from other countries.
Is there a way to forward port 80 ->443 in FortiWiFI?
Is there a policy that I can set to ensure that port 80 does not accept IPs from other countries
What is everyone doing to stop attacks in port 80?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
There are many ways to stop attacks at some port. But lets focus on what your target is.
You said that you want to port forward. Yes this can be done. You have to configure a VIP and then use this VIP in an IPv4 rule. That is the first part.
If you want then to allow traffic only from a specific country/countries, you have to configure an address object with type Geography (Geolocation) and then use this object as source at the policy you previously created.
Before you do that make sure that everybody who will access your server on your specified port is from the country/countries you created at the address object/s
Orestis Nikolaidis
Network Engineer/IT Administrator
orion,
Thank you for the suggestions.
Is there a step by step procedure as what to do on the port forward and specific country solution?
I am new to Fortigate and don't want to make any mistakes.
Thank you
Ok.
First lets create the address object. Go to "Policy&Objects"-->"Addresses" and click "Create New"- "Address"
Set a desired name, for the "Type" choose "Geography", choose your desired country (the one you want to allow traffic), "Interface" = any and click "OK".
Then you have to create you VIP.
Go to "Policy&Objects"-->"Virtual IPs" and click "Create New" - "Virtual IP"
Set a desired name. At the "Interface" choose your external interface/internet (the source of the traffic). At the External IP Address/Range set your interface's ip address. At the Mapped IP Address/Range set your IIS ip address. Enable the "Port Forwarding" option and set the external and internal ports.
Lastly you have to create a rule to allow traffic go through.
Go to "Policy&Objects"-->"IPv4 Policy" and click "Create New"
Set a desired name, Incoming intrface= your external interface/internet, Outgoing interface=The interface where IIS is physicaly connected to, Source= the address object you created before with the country you want to allow, Destination=your previously created Virtual ip object, Service=All, Nat = enabled, Log all sessions, enable this policy (on) and click ok.
And now you must be ready to safely use your server
Orestis Nikolaidis
Network Engineer/IT Administrator
Orion,
I have a question on Policy&Objects"-->"Virtual IPs"
Enable the "Port Forwarding" option and set the external and internal ports.
Protocol = TCP
External Service Port = 80
Map to port = 80
Is this correct? Looks like I am not doing a Port Forwarding because I am using port 80 for external and and Mapping
Yeah it seams right. In this scenario you just forward traffic on port 80 from external network to port 80 on your server at the internal network.
Another option is to forward/translate port. For example if you set external port 8888 and mapped port 80 you will forward external traffic from 8888 to 80 at your internal server.
This has to do on what you want. If your server listens to port 80 then mapped port should be 80. If you want your external users to hit port 80 then also your external port should be port 80.
Orestis Nikolaidis
Network Engineer/IT Administrator
Orani. Thank you for your help. I got it working now. I now using port 80 because is not secure. I am using port 443 and is working.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1692 | |
1087 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.