How to configure home router/firewall to allow Forticlient connections?

[netvpn15]

Hi,

I've a corporate laptop that uses Forticlient to establish a VPN
connection to corporate resources.

When working at home, when this corporate laptop is connected through the ISP
router, there's no problem connecting to the VPN server.

Now, I'm setting up my own router/firewall.

Using simple NAT rules, other systems can connect fine to the Internet, also the corporate
laptop can connect fine for everything except the VPN resources.
When I try to connect the VPN, Forticlient 2.7.8.1140 returns:
"a network error prevented updates from being downloaded".

It seems that for this kind of ssl vpn there are some special rules.
Can you please tell me what rules, protocols, ports, etc should I
consider in my router/firewall?

If you could show Linux iptables rules (or FreeBSD, OpenBSD, NetBSD equivalents), it would be very kind of you.

Thank you

[AEK]

Hi

No special rule needed, except need to open the outgoing connection to the remote SSL VPN server IP:port (usually TCP 443 or 10443).

NAT is fully supported.

[netvpn15]

---

@netvpn15 wrote:

Hi,

I've a corporate laptop that uses Forticlient to establish a VPN
connection to corporate resources.

When working at home, when this corporate laptop is connected through the ISP
router, there's no problem connecting to the VPN server.

Now, I'm setting up my own router/firewall.

Using simple NAT rules, other systems can connect fine to the Internet, also the corporate
laptop can connect fine for everything except the VPN resources.
When I try to connect the VPN, Forticlient 2.7.8.1140 returns:
"a network error prevented updates from being downloaded".

It seems that for this kind of ssl vpn there are some special rules.
Can you please tell me what rules, protocols, ports, etc should I
consider in my router/firewall?

If you could show Linux iptables rules (or FreeBSD, OpenBSD, NetBSD equivalents), it would be very kind of you.

Thank you

---

---

@netvpn15 wrote:

Hi,

I've a corporate laptop that uses Forticlient to establish a VPN
connection to corporate resources.

When working at home, when this corporate laptop is connected through the ISP
router, there's no problem connecting to the VPN server.

Now, I'm setting up my own router/firewall.

Using simple NAT rules, other systems can connect fine to the Internet, also the corporate
laptop can connect fine for everything except the VPN resources.
When I try to connect the VPN, Forticlient 2.7.8.1140 returns:
"a network error prevented updates from being downloaded".

It seems that for this kind of ssl vpn there are some special rules.
Can you please tell me what rules, protocols, ports, etc should I
consider in my router/firewall?

If you could show Linux iptables rules (or FreeBSD, OpenBSD, NetBSD equivalents), it would be very kind of you.

Thank you

---

Maybe there's some problem because of IPv6?
My filter table is all about IPv4:

table <int-block> type lpm

procedure "log"

map re0 dynamic any -> xxx.xxx.xxx.xxx pass family inet4 from 192.168.1.0/24 # id="1" 

group "external" on re0 { # id="1" 

pass stateful out final all # id="2" 

pass stateful in final family inet4 proto tcp flags S/FSRA to ifaddrs(re0) port 22220 # id="3" 

pass stateful in final proto tcp flags S/FSRA to ifaddrs(re0) port { 80, 443, 25, 53, 6000, 9022 } # id="4" 

pass stateful in final proto udp to ifaddrs(re0) port { 53, 123, 6000 } # id="5" 

pass stateful in final proto { tcp, udp } flags S/FSRA to ifaddrs(re0) port 17166 # id="6" 

pass stateful in final proto { tcp, udp } flags S/FSRA to ifaddrs(re0) port 44000 # id="7" 

pass stateful in final proto { tcp, udp } flags S/FSRA to ifaddrs(re0) port 23456 # id="8" 

pass stateful in final proto { tcp, udp } flags S/FSRA to ifaddrs(re0) port { 14111, 8555, 999 } # id="9" 

pass stateful in final proto { tcp, udp } flags S/FSRA to ifaddrs(re0) port 8123 # id="a" 

}

group "internal" on wm0 { # id="c" 

pass in final family inet4 from 192.168.1.0/24 # id="d" 

pass out final all # id="e" 

}

group default { # id="f" 

pass final on lo0 all # id="10" 

}

---

@netvpn15 wrote:

Hi,

I've a corporate laptop that uses Forticlient to establish a VPN
connection to corporate resources.

When working at home, when this corporate laptop is connected through the ISP
router, there's no problem connecting to the VPN server.

Now, I'm setting up my own router/firewall.

Using simple NAT rules, other systems can connect fine to the Internet, also the corporate
laptop can connect fine for everything except the VPN resources.
When I try to connect the VPN, Forticlient 2.7.8.1140 returns:
"a network error prevented updates from being downloaded".

It seems that for this kind of ssl vpn there are some special rules.
Can you please tell me what rules, protocols, ports, etc should I
consider in my router/firewall?

If you could show Linux iptables rules (or FreeBSD, OpenBSD, NetBSD equivalents), it would be very kind of you.

Thank you

---

Do you find anything wrong?  This is not even blocking anything.
Tried with
net.inet6.ip6.forwarding = 0
and also
net.inet6.ip6.forwarding = 1

IPv4 is set for forwarding:  net.inet.ip.forwarding = 1