Problem with VIP / Port Forwarding

[championc1]

What am I missing here ?  My traffic is hitting my WAN address, but is not hitting the LAN.  First of all, this is on an old 90D that I am playing with, so it's on it's highest release of 6.0.18

I am trying to hit a server inside my network from the outside.  My ISP router is outside the Firewall, and has all ports Port Forwarded.  I can see the traffic hit my Firewall

Spirit-FW # diag sniffer pack any "port 22" 4 0 a
interfaces=[any]
filters=[port 22]
2024-10-20 20:10:27.049346 wan1 in 93.107.205.221.41489 -> 192.168.1.17.22: syn 3251867515 
2024-10-20 20:10:28.057670 wan1 in 93.107.205.221.41489 -> 192.168.1.17.22: syn 3251867515 

But it won't hit my inside LAN.  I have a fully open Any Src / Any Dst / All services rule in place

I have a Virtual IP for 192.168.1.17 --> 10.10.5.100 (TCP: 22 --> 22)

Doing a Packet Capture too confirms the traffic to the WAN, but never his the LAN Interface

I'm sure that this is something stupidly simple that I am overlooking :(

Thanks in advance

[AEK]

The policy should have the VIP object as destination, and LAN interface as destination interface.

[championc1]

I actually created two rules, one for source specific IP to the VIP object, and then a secondary rule from Any to Any over interfaces WAN1 to LAN.  By messing about with things, I'm gradually getting hits.

[rahul_p1]

Hi,

Please refer to this article and make sure your configuration is correct :- How to configure VIP access where specifi... - Fortinet Community

[championc1]

This example if for a specific destination.  What about when a specific port is required ?  Suppose I want to route all traffic for HTTPS connections

As I see it, there are two options

Option 1 - Tick the Optional Filters and add HTTPS to Services, and in Port Forwarding, add 443

OR

Option 2 - Leave Optional Unticked, tick Port Forwarding, and add 443 as both External Service Port and the Map to Port 

Or is there another way that I have missed ?

Also, regarding filtering for a specific source, is there any way to filter for a specific source DynDNS name FQDN rather than an IP ?  If I wanted to allow a specific source only to reach a specific server internally, but if the source IP could change periodically ???

[borlinjo1]

VIPs should only really be used for external access I've never used them for internal facing port forwarding. If you're trying to get internal to internal that's segregated via vlan then you just need a simple policy and route setup correctly from destination to destination. Throwing a VIP into the equation makes this a bit more complicated then it needs to be.

[championc1]

Why are you saying Internal to Internal ?  Even the Diag Sniffer shows it arrives from a public IP on the WAN1 interface.  Or am I missing something ?

[parthpatel]

Hello,

You can try to run the debug commands with public IP address of your test machine as that will give you clear idea on what is missing on the configuration part.

# diagnose debug reset
# diagnose debug flow filter addr x.x.x.x [public IP address of your test machine]
# diagnose debug flow show function-name enable
# diagnose debug console timestamp enable
# diagnose debug flow trace start 999
# diagnose debug enable

--- try to generate the traffic from test machine to external IP address of VIP ---

# diagnose debug disable ---- to stop the debug 

[arahman]

Hi also attach your configuration related to vip to make sure the policies are correct and the vip is configured correctly