NAT rule issue with my Fortinet 60C

[vantho]

Hi All, I configured a Fortigate 60C. This one connected to Broadband Modem to get internet connection thru WAN1 port. From internet I could accessed to Firewall Web-Console thru Wan1 interface with using NAT rule in modem but couldn' t get in a PC inside LAN network. Had setup Virtual IP and Policy as followed a lot internet searching and advising. Any idea to help me out with this issue? Thanks a lot. Note: - Policy already allowed any from WAN to Internet with ALL Accept. - Virtual IP rule has pointed to Destination IP LAN. - Standing at Modem can' t ping to PC inside LAN (I don' t know how to setup ping policy can go thru). Thanks.

[ede_pfau]

hi, and welcome to the forums. If your VIP is port forwarding you will not be able to ping the internal server. Ping is an application of the ICMP protocol which doesn' t use ports. You will probably be forwarding TCP on port 80 or 443 which doesn' t cover ping. The only way to have ping go through a VIP is to make the VIP non-portforwarding. This will consume the public address completely, though. With a decent tool you could " tcp ping" your server - there are tools around which try to establish a TCP connection and report the response. BTW, best practise would put the ' exposed' server on a Fortigate port of it' s own, and not have external traffic traverse the whole LAN via the LAN switch. The 60C should have some spare ports for this... In your setup the default route on the FGT should point to the modem (.11.1). The WAN port of the FGT will not have a public IP which will make receiving the FortiGuard updates a bit more difficult. If possible, put the modem into ' bridge mode' and put all credentials onto the FGT. For instance, I do this for PPPoE ADSL modems. In this case, the FGT will be truly the gateway and have a public WAN IP. Anyway, does your setup work except for the ping? If you still have questions, please state the FortiOS version you are using.

[vantho]

Hi Ede_pfau, Thanks for welcoming me and your reply. - My FGT 60C using firmware v5.0 built 0147 (GA patch 1). - Yes, in diagram, default route exactly pointed to 11.1, it worked well without any problems even fetching Guard updates...Your idea to change ADSL to bridge mode is what I thought also..but would be better to remain the things for some reasons (on-line configure/not enough man-power there...). - Using " exposed" port as your mentioned that' s meaning we will hook the server into DMZ port ? I think the one will be the last consider with the reason as above listed. - in VIP I had allowed ALL, I though with using that option, ICMP protocol to allow ping command. Yes, ICMP does not using port, thank you. >> Do you have any experiences on how to allow user from Internet can go thru the Server inside LAN without changing ADSL/default gateway/DMZ port? looks like 02 times of NAT - 1 from Internet to WAN segment and 1 from WAN to LAN segment. Have tried many times with VIP/Policy/NAT but still not able to get traffic as wanted. Regards.

[ede_pfau]

I don' t see any reason why double NAT would prevent traffic if the correct routes are set. The modem in bridge mode was just a suggestion NOT related to your problem. I do it for a simple reason: no config on the modem itself. If it burns from line voltage spikes I can just send a replacement to the remote site and have it connected. Might be because I' ve had a long day (with family :) but I lost the idea what your problem really is: the FGT can connect to the FortiGuard servers (which I didn' t expect), and outbound traffic seems not to be the problem. Inbound traffic is using a VIP - be sure not to check ' port forwarding' which is different from specifying all ports. Whether you use the internal port for your server or another dedicated port of the FGT is a question of security, not of technical importance. I tell my customers to see the DMZ server as being hacked - how much more damage can an attacker inflict on the LAN then? With just one server in the DMZ, and NO policies from DMZ to internal LAN, not much...having the server in the middle of the internal LAN though makes a big difference. For further help, we need - the VIP definition - the policy it is used in (WAN -> internal) - the routing table (from Routing Monitor) if possible as text snippets from the command line/console.

[vantho]

Hi Ede, Here are some info config firewall vip edit " ServerNAT" set extintf " wan1" set portfoward enable set mappedip 192.168.10.50 set extport 80 set mappedport 80 next end edit 7 set srcintf " wan1" set dstintf " internal" set srcaddr " all" set dstaddr " all" set action accept set status disable set schedule " always" set service " ALL" next config router static edit 3 set device " wan1" set gateway 192.168.11.1 next At ADSL router, I had assigned the rule: Source ANY port 8080 transfer to port 80 interface WAN1. " ...but I lost the idea what your problem really is: the FGT can connect to the FortiGuard servers (which I didn' t expect), and outbound traffic seems not to be the problem" >>> Actually, if leave it as normal, Guard will not connect to servers...had just opened 2 ports in ADSL using connect to Guard services then it is ok. " Inbound traffic is using a VIP - be sure not to check ' port forwarding' which is different from specifying all ports" >>> I' m sorry that I can' t understand...can you please explain for me more? Any info that your need to investigation, please let me know. Thanks much.

[ede_pfau]

OK, that information was badly needed! 1. disable port forwarding in the VIP config 2. policy 7 is NOT active - ' set status disable' 3. create a new policy, with - source interface: wan1 - source addr: all - dest interface: internal - dest addr: your_VIP <==== this is important!! - no NAT 4. the static route is OK Now you can ping the server from the WAN port. To test, disconnect the modem, connect with a notebook with IP address .11.1 and ping the server. Try HTTP on port 80 also. And I see that your server will only be accessible via port 8080 from outside.

[vantho]

I will test that and keep you update, Ede...thanks a lot for your support.

[vantho]

Hi Ede, Tried to following your guide but still not able to access inside, event ping from modem back to Server NAT address. Much appreciated your time to look at this. Thanks. Please refer att' d of config file (rename the file to 11.zip before open).

[ede_pfau]

Thanks for your confidence. Please check and change these points: 1.

 config system interface
     edit " wan1" 
         set mode static
         set ip 192.168.111.2 255.255.255.0
 

shouldn' t that be in the 192.168.11.x range? 2.

 config firewall vip
     edit " ServerNAT" 
         set type static-nat
         set extip 0.0.0.0
         set extintf " wan1" 
         set portforward disable
         set mappedip 192.168.10.50
     next
 end

change to

        set extip 192.168.11.x
 

where 192.168.11.x is the external IP address used for the internal server 3. policies - delete, delete, delete policy ID 8 - policy 4 covers policy 5, I' d delete policy 5 - policy 7 (the NAT policy) looks OK

[vantho]

Dear Ede, Please see my in-line discussion as below: #1: This is my fault...I reverted back to the right IP address for WAN1 (11.2) #2 : Already changed as your guide. #3: Sorted out meaningless policy 8, policy 5 actually has a little bit different with 4 so I will keep that. But...:-( still can' t. What am I missing? Thanks.