Issue with only one of my NAT rules

[wseyller]

I have a new Fortigate 80E installed. Issue is that anyone externally should be able to access an http webpage from a security camera system on an internal network but this doesn't work at all. Internally the webpage 192.168.4.2:8282 works just fine.

Source ip: any Destination IP: 100.100.100.98 Destination port: 8282

should translate to

Source ip: original destination ip: 192.168.4.2 Destination port: 8282

I have many other similiar and more complex translations for exchange server, webpage (port 80) on a different server, vpn that runs on an internal server. All of these work just fine. Only difference I believe is that the Security camera is on a different internal interface. The NAT rules that work are all on the main lan interface 192.168.0.0/24

I ran the protocol analyzer on the wan. I could see the attempt from the source device but no response from destination. I also ran a test on the security camera interface and I see no packets mentioned from the source ip or the port 8282.

I am posting all of the config that I believe is relevant. The public IPs were changed for censorship.

#config-version=FGT80E-6.0.2-FW-build0163-180725:opmode=0:vdom=0:user=Fortimanager_Access
#conf_file_ver=729792253171645
#buildno=0163
config system interface
    edit "wan1"
        set vdom "root"
        set ip 100.100.100.98 255.255.248.0
        set allowaccess ping https ssh fgfm
        set type physical
        set scan-botnet-connections block
        set alias "Charter Fiber"
        set estimated-upstream-bandwidth 25600
        set estimated-downstream-bandwidth 25600
        set role wan
        set snmp-index 1
        set secondary-IP enable
        config secondaryip
            edit 1
                set ip 100.100.100.99 255.255.248.0
            next
            edit 2
                set ip 100.100.100.100 255.255.248.0
            next
            edit 3
                set ip 100.100.100.101 255.255.248.0
            next
        end
    next
    edit "wan2"
        set vdom "root"
        set ip 200.200.200.106 255.255.248.0
        set allowaccess ping https ssh fgfm
        set type physical
        set scan-botnet-connections block
        set alias "Charter Broadband"
        set estimated-upstream-bandwidth 102400
        set estimated-downstream-bandwidth 8192
        set role wan
        set snmp-index 2
        set secondary-IP enable
        config secondaryip
            edit 1
                set ip 200.200.200.107 255.255.248.0
            next
            edit 2
                set ip 200.200.200.108 255.255.248.0
            next
            edit 3
                set ip 200.200.200.109 255.255.248.0
            next
            edit 4
                set ip 200.200.200.110 255.255.248.0
            next
        end
    next
     edit "port4"
        set vdom "root"
        set ip 192.168.4.1 255.255.255.0
        set allowaccess ping https ssh
        set type physical
        set alias "Security-Cam"
        set snmp-index 9
    next
    edit "lan"
        set vdom "root"
        set ip 192.168.0.253 255.255.255.0
        set allowaccess ping https ssh http fgfm capwap
        set type hard-switch
        set alias "Main LAN"
        set stp enable
        set role lan
        set snmp-index 7
    edit "ABE_local_SEC-CAMS"
        set uuid fb9d92f4-092c-51e9-7b02-925e1deda923
        set subnet 192.168.4.0 255.255.255.0
    next

    edit "ABE-CAMERA"
        set category "VoIP, Messaging & Other Applications"
        set tcp-portrange 8282 50100
        set udp-portrange 8282 50100
    next
config firewall vip
    edit "ABE-CAMERA-FIBER98"
        set uuid 97072476-0941-51e9-9445-65612d674389
        set service "ABE-CAMERA"
        set extip 100.100.100.98
        set extintf "wan1"
        set mappedip "192.168.4.2"
    next
    edit "ABE-CAMERA-BROADBAND106"
        set uuid a8bebe04-0941-51e9-a7da-60a3d3798684
        set service "ABE-CAMERA"
        set extip 200.200.200.106
        set extintf "wan2"
        set mappedip "192.168.4.2"
    next
end
config firewall vipgrp
    edit "ABE-NAT-BROADBAND"
        set uuid 2a9e6d16-0942-51e9-afc1-5fabd6d288ea
        set interface "wan2"
        set member "ABE-CAMERA-BROADBAND106" "ABE-ESN-BROADBAND106" "ABE-EXCHANGE-BROADBAND106" "ABE-IDRAC-BROADBAND106" "ABE-REMOTE-TECH-BROADBAND107"
    next
    edit "ABE-NAT-FIBER"
        set uuid 8698a230-0942-51e9-d5b5-197ae43f51f4
        set interface "wan1"
        set member "ABE-CAMERA-FIBER98" "ABE-ESN-FIBER98" "ABE-EXCHANGE-FIBER98" "ABE-REMOTE-TECH-FIBER99" "ABE-VPN-FIBER99"
    next
end
config firewall policy
    edit 8
        set name "SECURITY-CAMERA"
        set uuid e007e5b6-0fdb-51e9-d291-7ed4686f7e2d
        set srcintf "wan1" "wan2"
        set dstintf "port4"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set status enable
        set schedule "always"
        set service "ALL"
    next
    edit 5
        set name "ROUTE-BETWEEN-LOCAL-LANS"
        set uuid f6b498e8-092a-51e9-3ecc-ec263eef57e0
        set srcintf "port3" "lan" "port4"
        set dstintf "lan" "port4" "port3"
        set srcaddr "ABE_local_LANS"
        set dstaddr "ABE_local_LANS"
        set action accept
        set status enable
        set schedule "always"
        set service "ALL"
    next
     edit 6
        set name "PUBLIC-SERVER-ACCESS"
        set uuid 8dc393fc-0943-51e9-ea7b-8fcdc223da50
        set srcintf "wan1" "wan2"
        set dstintf "lan"
        set srcaddr "all"
        set dstaddr "ABE-NAT-BROADBAND" "ABE-NAT-FIBER"
        set action accept
        set status enable
        set schedule "always"
        set service "ALL"
        set nat enable
    next
    edit 1
        set name "Charter-Fiber-Policy"
        set uuid 23754fc2-bbf5-51e8-4935-3c2b07c1bdd3
        set srcintf "lan" "port3" "port4"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set status enable
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set av-profile "default"
        set webfilter-profile "default"
        set dnsfilter-profile "default"
        set ips-sensor "default"
        set application-list "default"
        set ssl-ssh-profile "certificate-inspection"
        set nat enable
    next
    edit 2
        set name "Charter-Broadband-Policy"
        set uuid 29cf5896-0910-51e9-b2ec-695665650119
        set srcintf "lan" "port3"
        set dstintf "wan2"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set status enable
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set av-profile "default"
        set webfilter-profile "default"
        set dnsfilter-profile "default"
        set ips-sensor "default"
        set application-list "default"
        set ssl-ssh-profile "certificate-inspection"
        set nat enable
    next

 
 
 

[ede_pfau · Accepted solution]

hi,

your VIPs are all correct.

I personally would not include a 'service' parameter, and if so, I would port-translate only one port (8282) and one protocol (probably TCP). You've got all the information to narrow it down, this could become beneficial later.

The problem is that you define the camera VIP but don't use it. Add it as the destination address in policy 8. This makes it work.

Some remarks:

IMHO using multiple interfaces is a bad thing; it saves some time when creating the policy but costs a lot later, for instance when you follow traffic through routing and policies. I can see that you would have many nearly identical policies if you'd use only one interface per policy. For me, this indicates your network/port setup is not optimal.

If you want to group interfaces to save on the number of policies then use zones. They are treated just like interfaces but this will keep the 'interface pair view' of the policy table. Still not ideal for debugging, though.

But again, this is just my personal preference and experience. Your problem is in policy 8.

[wseyller]

Thanks for the information and advice. The zone configuration I just found after you mentioned it. Seems I will need to wait for implementing zones as I have little maintenance window to redo it that way.

So policy 8 I just added because I was trying different ways to make it work. So if you imagine that policy doesn't exist or is disabled. I forgot to mention this.

The policy I am really using for the security camera is #6 "PUBLIC-SERVER-ACCESS" which references dst address "ABE-NAT-FIBER" which has a VIP group member of "ABE-CAMERA-FIBER98".

VIP "ABE-CAMERA-FIBER98" has the "ABE-CAMERA" service.

Everything such as the email, vpn, and other webpage is using this one policy #6.

I agree with just using tcp 8282. At one point I had it that way in one of the variations I have tried to fix this. The old router I replaced had both tcp/udp for 8282 and 50100.

[wseyller]

So I decided to rip out all the configuration referencing the security camera policy.  I created a new custom service for tcp 8282 for the web page and also tcp 50100 for the android app. 

I created a new VIP.

I decided to create a separate ipv4 policy for this.

And for whatever reason now the webpage works and the app works.

Thanks