Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
hserna
New Contributor

Port-Forwarding same ip different port

Hi, How can I redirect, for example, the port 2525/TCP to port 25/TCP on the same IP. So, the same IP will receive SMTP conections at port 25/TCP and 2525/TCP. Thx
12 REPLIES 12
rwpatterson
Valued Contributor III

Welcome to the forums When you create the VIP (virtual IP) definitions, check off the port forward option, and select the port to send over.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
hserna
New Contributor

Thanks for your reply ! Probably I wasn' t clear enough ! I have a Mail Server, which has a public IP (let' s say 2.2.2.2), which is connected to the DMZ port (let' s say 2.2.2.1). Those IP addresses are part of a subnet block (let' s say) 2.2.2.0/29, which is routed to the Fortinet. So I have access to the Mail Server from Internet. I have a Firewall Policy (wan1 -> dmz) to allow connections to port 25/TCP for SMTP. And, obviously, it' s working. But, I want to receive SMTP connections to port 2525/TCP too (redirected to port 25/TCP), without make any adjustments in my Mail Server. So, I can receive SMTP connections in both ports (transparently). I can do that with IPTABLES in Linux Based Firewall, using a simple PREROUTING Rule: iptables -t nat -A PREROUTING -p tcp -d 2.2.2.2 --dport 2525 -j DNAT --to-destination 2.2.2.2:25 How can I do it with Fortinet ?
rwpatterson
Valued Contributor III

Create a VIP rule, put port 2525 on the outside and port 25 on the inside. Simple as that. Use SMTP as the service in the policy, and you' re done.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
hserna
New Contributor

I' ve tested it, and It doesn' t work. If I put 2.2.2.2 on both External IP and Mapped IP. The 2.2.2.2 doesn' t respond any connection, not even 25/TCP.
rwpatterson
Valued Contributor III

The mapped IP has to be the server, and it' s port needs to be 25. 2.2.2.2 is the public IP. You need to map to the private IP address for this to function.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
hserna
New Contributor

Ok, so it have to be a private address to work? Because my Mail Server has the 2.2.2.2 (public), as I told you, I have the subnet block 2.2.2.0/29 routed to the Fortinet. So, the whole block is in the DMZ.
red_adair
New Contributor III

@hserna: stupid Q: - did you put a Policy in place ext:all -> dmz:VIP / allow (DST-Addr in the Policy would be the VIP you have created) -R.
hserna
New Contributor

Of course ! Don' t get me wrong, but I have about 4 years of experience with Fortinet. I' ve try it in some many ways. But none had ever worked. But yesterday I needed it again, so I give a try asking in the forum. Have anyone ever try it ? There are several cases: 1. Same Public IP (already asigned and routed in the DMZ), different ports: Port 2.2.2.2:2525 redirected to 2.2.2.2:25 2. Different Public IPs (already asigned and routed in the DMZ), same port: Port 2.2.2.2:25 redirected to 2.2.2.3:25 3. Same mapped IP (public <-> private, using VIP), different ports: Port 2.2.2.2:2525 redirected to 192.168.1.2:25 Where 2.2.2.2 is already a VIP (Static NAT) of 192.168.1.2 4. Different mapped IPs (public <-> private, using VIP), same port: Port 2.2.2.2:25 redirected to 192.168.1.3:25 Where 2.2.2.2 is already a VIP (Static NAT) of 192.168.1.2 Where 2.2.2.3 is already a VIP (Static NAT) of 192.168.1.3 I' ve never make this 4 cases work. But, as I told earlier, I can make it work with IPTABLES (Linux). So, I think it have to be a way of doing it. I really appreciate your time and pacience.
rwpatterson
Valued Contributor III

I just tried #3 in my 1000a with my mail server, and it seemed to have worked. I don' t have another mail server to configure to that port to test the traffic, but I didn' t get any errors making the rules.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors