How to open port 80

[#1]

Hello, please tell me how to open port 80. I`ve got Fortigate 60B with OS FGT60B-4.00-build272. Thanks, bartezgo

[Fullmoon]

in what cases you want to open port 80?could you state what to achieve on your environment?

[#3]

I' m gonna join in on this request seeing as I' m sure it will apply to me. I have an internal server that I' m trying to get traffic to over ports 80, 8081, and 4899. In my firewall policies, nothing is working out. let' s start with the more imporant configuration. here are some screen shots: This policy is supposed to point webserver running services on port 8081. Remotely, I can ping the FortiGate, but I can' t web browse on that port or port 80 (which is also configured for this server in the same policy)

[rwpatterson]

@ bartezgo Are you trying to get to port 80 on the FGT or on some other internal device? @ Bartimus Create a Virtual IP (under ' Firewall -> Virtual IP' ), then use that as the definition in a policy. The service has to match the end service, not the service shown on the outside port. For example, if your outside port 8081 was to be sent to port 80 on the inside, then the service you need in the policy is HTTP.

[#5]

Did it work? My even simpler setup doesn' t work on a FGT60*. I' ve one fixed public IP (edited out below) and would like to access a web server from the Internet. Here the relevant config config system interface edit " internal" set vdom " root" set ip 192.168.1.10 255.255.255.0 set allowaccess ping https http telnet set type physical next edit " wan1" set vdom " root" set ip <my public IP>/<subnet mask> set allowaccess ping https set type physical next config firewall vip edit " Webserver" set extip <my public IP> set extintf " wan1" set portforward enable set mappedip 192.168.1.2 set extport 80 set mappedport 80 next config firewall policy edit 1 set srcintf " internal" set dstintf " wan1" set srcaddr " all" set dstaddr " all" set action accept set schedule " always" set service " ANY" set nat enable next edit 2 set srcintf " wan1" set dstintf " internal" set srcaddr " WebServExt" set dstaddr " WebSrv" set action accept set schedule " always" set service " HTTP" set nat enable set fixedport enable next end I did a: diagnose sniffer packet wan1 ' tcp port 80' Packets arrive destined for port 80 but diagnose sniffer packet internal ' tcp port 80' does not show anything. I changed various settings in the firewall policy: - with and without NAT - with and without fixed port Did anyone succeed setting up such a simple configuration? not so ' sharp_mind' *FGT-60-3.00-FW-build741-090408

[abelio]

hello and welcome

config firewall vip edit " Webserver" set extip <my public IP> set extintf " wan1" set portforward enable set mappedip 192.168.1.2 set extport 80 set mappedport 80 next

Did you also free the ' 80' administrative port from System->Admin->Settings? Does have 192.168.1.2 the FTG' s internal interface as default gateway?

[ede_pfau]

Yes, I was about to point to the same: you have HTTP enabled on the ' internal' port. HTTP traffic is accepted by the FGT itself then and not sent through it.

[#8]

Thanks for yur reply. Yes port 80 is " freed from adimistrative duties" , see the paragaph " wan1" in my post. After my post UNchecked HTTP from any other interfaces. Admin port for HTTP is set to 8080. In the CLI window I typed in: diagnose sniffer packet internal ' tcp port 80' This should show any packets destined for port 80. Nothing displayed. I still don' t see any traffic even without filter. On the external interface I see traffic for port 80 coming in. Gateway on the webserver is set to the internal IP of my FGT Clueless sharp_mind

[Carl_Wallmark]

of what i can see from your config: on the Wan1 -> Internal policy: set source address to " all" on destination address, select the name of the VIP you created uncheck the NAT box, doing a VIP makes it nat.

[#10]

As sad as it may sound I used to manage an FGT800 which was decommissioned a few years back. It did exactly what I want to do (among other things). So I looked up the config and started with my FGT60 over again. Here is the relevant portion of the new config (public IP edited out): config system interface edit " internal" set vdom " root" set ip 192.168.1.10 255.255.255.252 set allowaccess ping https telnet set type physical next edit " wan1" set vdom " root" set ip <public IP> 255.255.255.252 set allowaccess ping set type physical next end config firewall vip edit " WebserverInbound" set extip <public IP> set extintf " wan1" set mappedip 192.168.1.2 next end config firewall policy edit 1 set srcintf " internal" set dstintf " wan1" set srcaddr " all" set dstaddr " all" set action accept set schedule " always" set service " ANY" set nat enable next edit 2 set srcintf " wan1" set dstintf " internal" set srcaddr " all" set dstaddr " WebserverInbound" set action accept set schedule " always" set service " HTTP" next end config router policy edit 1 set input-device " internal" set src 192.168.1.2 255.255.255.255 set gateway <public IP> set output-device " wan1" next edit 2 set input-device " wan1" set dst <public IP> 255.255.255.255 set gateway 192.168.1.10 set output-device " internal" next end I captured packet with: - diagnose sniffer packet ' wan1' ' 80' - diagnose sniffer packet ' internal' ' 80' - diagnose sniffer packet ' internal' ' ' I saw traffic coming in on wan1 but did not see any traffic ' internal' . So I assume that' s where the problem is. For the FGT800 I had serveral public IPs and now I have one single public IP. Anyone any ideas? not so sharp_mind