Fortigate Firewall 140D v5.2.7

[faraziqbal81]

Hi Admin,

We have some customer located in China where Google.com is blocked. Users are having issues to load the javascripts content which points to google.com servers. Eg. is of CAPTCHA which doesn't open on the pages.

Is there any way in fortigate to redirect all the google traffic to a different location instead of hitting on the GATEWAY FIREWALL IN CHINA.

[Michael_McDonnell]

I think the usual solution to this would be to employ a VPN, though those could be blocked.  See this thread:

https://forum.fortinet.com/tm.aspx?m=131989

Another possibility would be URL rewriting, but I do not think FortiGate can do that. FortiWeb does support URL rewriting.

Similar to that would be DNS translation. This is a feature of the FortiGate where you can alter DNS query results. You can force a DNS query to replace one IP with another of your choosing.  Because "google" uses many IP addresses, I am not sure this will work and even then the IP addresses might be blocked.  VPN is probably your best bet.

If you want the IP A.B.C.D to be changed to E.F.G.H in all DNS queries:

config firewall dnstranslation

  edit 1

    set src A.B.C.D

    set netmask 255.255.255.255

    set dst E.F.G.H

  next

end

[ede_pfau]

I agree. A site to site VPN would usually be of type IPsec. It's protocol (ESP) might be prone to blocking though. In this case, create an SSLVPN for client-to-site tunneling.