Fortigate blocking random outgoing ports

[MaeIstrom]

I have a fortinet v7.0.12 router and it's configured to nat and allow all traffic from the internal network to the internet. There's a firewall rule for internal -> wan with source/destination/Service set to 'all' and the security police is no-inspect. This seems to work for most things, internal users can access web site but some outgoing connections are blocked. Notably ports 8007 and 25 don't work. Where else would these connections be getting blocked if not the firewall?

[ozkanaltas]

Hello @MaeIstrom ,

When you review forward traffic logs, can you see blocked traffic logs? 

If you are not, this traffic can be blocked by the ISP. Generally, ISPs don't like 25 traffic. Because of that, they can block 25 traffic.

[MaeIstrom]

Port 25 seems to be working after an ISP change. 8007 is still blocked. More specifically port 8007 on a system that does port forwarding to 8007 on an internal ip. Or any port that is being DNATed. The machines behind the fortinet can access any other public ip or port. The DNAT system works for any other machine including ones behind an SNAT router. I've turned off SSL inspection and even unencrypted traffic just times out.

[MaeIstrom · Accepted solution]

Just did a traceroute from one of machines behind the fortinet and the first hop was the routers internal IP the second is something other than it's public IP, same subnet but ending in .1. So apparently the ISP is doing NAT I guess