Fortinet VPN/DMZ - local website accessible from outside of network

[Everstay]

Hello,

Im unsure how to properly word my question so bare with me.

We're currently running Fortigate as our firewall and vpn to which we connect from outside of our network to work remotely when needed. We're also in process of implementing an employee web panel, which needs to be accessible from outside of our network.

Im new to fortinet and unsure how to properly set it up. We have a public ip that we use for vpn connections, and I'd like to use that ip address to redirect web traffic from specific port to local ip

Example:

local web panel address: 10.1.2.63 (running default on port 8080 (this will be changed at later date - lets use this as example though)

public vpn ip address (not actual, just random for example purposes): 83.0.109.50.

Now, what do i need to do to be able to use 83.0.109.50:8080 outside of my network to access that web panel (83.0.109.50:8080 will point to 10.1.2.63 locally)

Please feel free to ask any questions for information i might've missed.

Many thanks for your assistance!

[Everstay]

Oh im sorry :D It hasnt' On https browser reports: domain.com took to long to respond

[ozkanaltas]

Could you run this command on Fortigate CLI . "execute telnet 10.1.2.63 443"

[Everstay]

ID420 # execute telnet 10.1.2.63 443
Trying 10.1.2.63...
Failed to connect to specified unit.

And port 80 seems to connect

ID420 # execute telnet 10.1.2.63 80
Trying 10.1.2.63...
Connected to 10.1.2.63.

[ozkanaltas]

Your web server not listen port 443. You need to check web server configuration. 

[Everstay]

My thought too. I will double check tomorrow when im there and will report back if you managed to save my life :D

[hbac]

Hi @Everstay,

You can run debug flow to see if the traffic is being dropped or not. Please refer to https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connecti...

With the example below, you can replace x.x.x.x with the source public IP address: 

di deb disable
di deb res
diagnose debug flow filter clear
di deb flow filter port 443
di deb flow filter addr x.x.x.x
diagnose debug flow show function-name enable
di deb flow show iprope en
diagnose debug console timestamp enable
diagnose debug flow trace start 500
diagnose debug enable

Regards,