How to allow port 1443

[#1]

I had added a custom Service under FIREWALL for TCP 1443 for destination and source . I also added a new address and created a policy base on it. However users are still unable to log into the website. Any idea? I am using 200A

[ede_pfau]

Hi, do you use a VIP to lead the traffic from WAN to internal port? It would help a lot if you could post - your FortiOS version - the policy - the config of your custom service One more, you are sure that you still use the default ports for administration of the Fortigate (http=80, https=443)?

[#3]

ORIGINAL: ede_pfau Hi, do you use a VIP to lead the traffic from WAN to internal port? It would help a lot if you could post - your FortiOS version - the policy - the config of your custom service One more, you are sure that you still use the default ports for administration of the Fortigate (http=80, https=443)?

I am quite a novice to this device. How to check is it is VIP to lead the traffic? -Firmware version: v4.0,build0178,090820 (MR1)

[Citylight]

You definitely must follow Maiks advice and change the source ports. Otherwise it will work only in one case: the source is really 1443 and that' s a one-hit wonder. Citylight

[Fullmoon]

ORIGINAL: cookiegal

ORIGINAL: ede_pfau Hi, do you use a VIP to lead the traffic from WAN to internal port? It would help a lot if you could post - your FortiOS version - the policy - the config of your custom service One more, you are sure that you still use the default ports for administration of the Fortigate (http=80, https=443)?

I am quite a novice to this device. How to check is it is VIP to lead the traffic? -Firmware version: v4.0,build0178,090820 (MR1)

Name: Port 1443 Protocol Type: TCP/UDP Protocol:TCP Source Port: Low:1024 High:65535 Destination Port: Low:1443 High:1443

[Maik]

custom Service under FIREWALL for TCP 1443 for destination and source

Change the source to 1024 - 65535 regards Maik

[#7]

Hi maik, isnt this opening up to more unneccessary ports?

[Maik]

Hi maik, isnt this opening up to more unneccessary ports?

no to get a feeling what' s going on, enter the " netstat.exe" command in a command shell of your windows client and study it' s output

[rwpatterson]

Just an FYI: Any time you see ' port' in this firewall it' s destination port unless otherwise specified.

[ede_pfau]

In case you wonder why everyone tells you to change the source ports and nobody tells you why: - TCP/UDP services use specific DESTINATION ports. You identify your HTTP custom service by the destination port 1443. Clients connecting to your server use random SOURCE ports so you have to allow a port range. But you only have to allow from port 1024 upwards as ports below are reserved for services. The highest possible port number is 65535 (=64K - 1). So that will fix your custom service definition. Again, if I could see your policy we could proceed from here.