Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Everstay
New Contributor II

Fortinet VPN/DMZ - local website accessible from outside of network

Hello,

 

Im unsure how to properly word my question so bare with me.

 

We're currently running Fortigate as our firewall and vpn to which we connect from outside of our network to work remotely when needed. We're also in process of implementing an employee web panel, which needs to be accessible from outside of our network.

 

Im new to fortinet and unsure how to properly set it up. We have a public ip that we use for vpn connections, and I'd like to use that ip address to redirect web traffic from specific port to local ip

 

Example:

local web panel address: 10.1.2.63 (running default on port 8080 (this will be changed at later date - lets use this as example though)

public vpn ip address (not actual, just random for example purposes): 83.0.109.50.

 

Now, what do i need to do to be able to use 83.0.109.50:8080 outside of my network to access that web panel (83.0.109.50:8080 will point to 10.1.2.63 locally)

 

Please feel free to ask any questions for information i might've missed.

Many thanks for your assistance!

 

 

25 REPLIES 25
ozkanaltas
Valued Contributor III

Hello @Everstay ,

 

You can use VIP (dnat) for your request. You can review these links for how to create VIP object on Fortigate. 

 

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/155333/virtual-ips-with-port...

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configurati...

 

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Everstay
New Contributor II

Hey! Many thanks for your reply. Im getting an error unfortunately

"

  • The extip is overlapped with the gateway of static route.
  • Object check operator error, -5, discard the setting."

I've gathered its because of the external ip address - i dont have any virtual ips defined - this will be the first one, and the external ip im using is also used for vpn connections - is that a problem?

ozkanaltas
Valued Contributor III

Hello @Everstay ,

 

If you use a different than ssl-vpn port for your web server, there will be no problem.

 

For example, if you use 443 for ssl-vpn. You can use 8080 or 8443 for a web server.

 

But the interesting thing is this "The extip is overlapped with the gateway of static route.". Which IP address did you try to configure VIP? Your public IP address or your gateway address?

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Everstay
New Contributor II

Yes that was the issue with this error, i've changed it to the actual wan ip now and it saved properly, also applied the firewall policy, but it seems like the port is reporting as closed from outside the network and doesnt allow any incoming traffic. ip is pinging of course as its the primary vpn ip but www doesnt seem to work

Also the VIP is reporting hits, dont know if thats good? 

ozkanaltas
Valued Contributor III

Hello @Everstay ,

 

Could you share your VIP and policy configuration with us? 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Everstay
New Contributor II

I've attached some images from the vip page, firewall policies and wan settings

 

fw.pngvivp.pngwan.png

ozkanaltas
Valued Contributor III

Hello @Everstay ,

 

Your configuration seems correct. Could you change interface settings "any" to "wan" in the VIP configuration? 

 

Also, could you try to execute telnet to your web server with this command? 

"execute telnet 10.1.2.63 8080" . With this command, we can test connectivity between Fortigate and the web server and web service up or down.

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Everstay
New Contributor II

I have changed the interface to wan. Below are logs from telnet 

"ID420 # execute telnet 10.1.2.63 8080
Trying 10.1.2.63...
Failed to connect to specified unit.

ID420 # execute telnet 10.1.2.63
Trying 10.1.2.63...
Failed to connect to specified unit.

ID420 #"

ozkanaltas
Valued Contributor III

Hello @Everstay ,

 

Apparently, your web server does not listen 8080 port or your FortiGate can not access the web server.

 

Firstly, you need to check your web server. On this server,
-Service UP/Down
-Service run on 8080 port?
-Is there any firewall or antivirus installed on this server?

 

After the check, you need to control connectivity between FortiGate and the Web server.

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors