Port forwarding with Dynamic Public IP

[Nark0t]

HI all,

I'm having an issue with port forwarding using a dynamic public IP, I have gone through the Fortinet cookbook and setup everything as follows:

But I think I am missing something somewhere as I cannot get it to forward port 37777 and access the device externally, I am currently using the Fortiddns services for updating my dynamic public IP.

Thanks in advance

[rwpatterson]

The problem is probably in your custom service. Source port range should be 1-65535, destination should be 37777-37778. You haven't posted that part, so this is an assumption.

Scratch that. I now saw at the bottom you did provide that piece.  Check that the cameras work as expected from the inside. After that, check to see if the camera server can get to the Internet. The problem seems to be traversing the firewall.

[Dave_Hall]

I agree with Bob - the VIP looks right.  If you have external access to the fgt's GUI via the DDNS name then I say that part is working. 

If you have not done this already, I suggest adding the bytes (or count) column to the IPv4 policy screen and watch the byte count on the firewall policy for the port forward to see if it increases as you attempt to access the camera.  If the count increases but have no access then I say the problem may be on the camera side going out. 

Also is the public IP directly assigned to the fgt or is that just the public IP assigned to a gateway device that the fgt is connected to?  If the latter then perhaps you may also need to set up port forwarding or opening up ports on the gateway device.

[Grave_Rose]

The first thing is that you're trying to map a port range (37777-37778) to a single destination port (37777). Put in the "map to port" area as "37777-37778" which should help.

Following that, I would run the following:

[ol]

Start on the outside with "diag sniffer packet wan 'port 37777 or port 37778' 6 10"

While this is running, test from the outside. You should see (at least) a SYN packet showing up from the outside client. If you don't see this, there's an upstream problem. If you do see it, move to the next step.

Stop the PCap and start a new one on the inside with "diag sniffer packet internal 'host 192.168.100.253 and (port 37777 or port 37778)' 6 10"

With this running, try your connection again. You should see (at least) a SYN packet showing up from the outside client. If you don't see this, check the next step. If you do see it, skip to step 6.

The firewall is dropping the packet. Run the following commands to debug it:[ol]

diagnose debug disable diagnose debug flow trace stop diagnose debug flow filter clear diagnose debug reset diagnose debug flow show function-name enable diagnose debug flow show iprope enable diagnose debug flow filter proto 6 diagnose debug flow filter port 37777 diagnose debug flow trace start 3 diagnose debug enable

Run your external test again and look at the drop codes.

Run "diagnose debug disable" to stop the debug.

Examine the drop codes to identify the issue.[/ol]

The packet is traversing the firewall successfully at this point. Run a PCap on the next-hop device (router, switch, whatever) and repeat this step until you reach the destination of 192.168.100.253.

If possible, run a PCap on this device (tcpdump, Wireshark, etc.) and verify that the initial SYN packet arrives.

If it does, make sure it sends a SYN/ACK outbound and repeat these steps in reverse order.[/ol]

At any point you come across a device where either (a) the packet doesn't arrive correctly or (b) doesn't leave correctly then investigate that device. When I say "correctly" it may arrive but have the wrong port, it may leave out the wrong interface, have the wrong NAT address or whatever.

As long as you follow the packet, you'll find out where your problems are. :)

I hope this helps,

Sean (Gr@ve_Rose)

[rwpatterson]

Grave_Rose wrote:

The first thing is that you're trying to map a port range (37777-37778) to a single destination port (37777). Put in the "map to port" area as "37777-37778" which should help.

The firewall filled in the second port in the range, grayed out there in the screen shot.

[Grave_Rose]

It's almost three in the afternoon and I still need more coffee. :) Thanks for pointing that out, @rwpatterson

[Nark0t]

Thanks guys, 

yes I can access the firewall externally via the ddns as I have setup the gateway device to forward all external traffic to the IP address it has assigned to my firewall.

I will take the steps provided to me and work through them today, and revert back to you guys with my findings.