Redirect all internal traffic to services (like NTP, DNS,...) at any IP to specific internal IP

[BockChrDiakonissen]

We have switched from Sophos UTM to Fortigate and we used to have DNAT rules to redirect all internal traffic to any destination with specific service to secific internal IP. 

scr.ip ANY > dst.ip ANY > dst.port tcp-udp/123 > dst.ip 10.20.30.40 > dst.port tcp-udp/123
src.ip ANY > dst.ip ANY > dst.port udp/53      > dst.ip 10.20.30.50 > dst.port tcp-udp/123

I only can find DNAT via Virtual IP - but there is no option to create rules like above.

Can anyone help me out or open my eyes to find the way to go.

Thx and greetings
Christian 

[AEK]

Try add VIP as follows:

• Interface: internal
• External IP: 0.0.0.0
• Mapped IP: 10.20.30.40
• Port forwarding: 53 mapped to 53

And add firewall rule as follows:

• Src intf: internal
• Dst intf: WAN (or any)
• Src: all
• Dst: all
• Svc: DNS

Hope it helps.

[BockChrDiakonissen]

This was my first attempt. But Forti will not allow this for Ext Int.

0.0.0.0 --> error: IP must not be zero

0.0.0.0/0 --> error: Invalid IP Range

0.0.0.0-255.255.255.255 --> error: IP must not be zero & IP range too large for mapped IPs

[AEK]

Which FortiOS are you using?

On my 7.0.17 I can specify 0.0.0.0 as external IP.

[BockChrDiakonissen]

We are using 7.4.8

And your screen shows exactly, what i wish to do.

Even on CLI we can't do it.

Our Service Provider don't know, why anybody would like to do this... :(