SSH not answering through VIP

[pprx]

Hi guys,

i got some problem and i cant figure this out.

I have a virtual machine on server which will be a mail server in future. Ive created a VIP on Forti that is internal address mapped to public. It pings and is visible from outside but services are not responding at public address f.e. SSH port 25.I also added even port forwarding for all ports 1-65535 and it still doesnt answer. Anyone got an idea what to do? I can log in to machine from our internal network through SSH but i cant do the same when i try to log in to public address

[pminarik]

I wouldn't be surprised if an ISP blocked TCP/25.

Have you checked whether the packet reaches the FortiGate at all?

> diag sniffer packet <wan-intf-name> "host <VIP external IP> and port 25" 4 0 a

=> test

CTRL+C to stop

[dingjerry_FTNT]

Hi @pprx ,

We need to check whether the traffic on port 25 is arriving on FGT first.  Please run this command to confirm:

diag sniffer packet any 'host <client public IP> and port 25' 4

[dingjerry_FTNT]

And you can get your client public IP via https://www.whatismyip.com/

[Toshi_Esumi]

You meant "SSH TCP port 22", right? TCP 25 is SMTP.

Toshi

[dingjerry_FTNT]

I think that he is going to setup a mail server on port 25, so he is testing with port 25.

@pprx , please test with "telnet", not "SSH".

[Toshi_Esumi]

I thought he was testing with SSH/TCP 22 although his final objective is to make SMTP server work behind the FGT. That's a reasonable test if he allowed just all ports to be forwarded to the server.
If you have doubt about your VIP config, the first thing I would do is to sniff on the FGT's outgoing interface if the SSH access from outside is actually forwarded to the target server.
If it's forwarded at the FGT as intended, the next thing is to run Wireshark on the server if it's receiving those packets.

By that time, you're probably clear where the problem resides and what's going on to fix it.
If you still have doubt about your VIP config, you can share the config under "config firewall vip" with us after masking your real public IP.

Toshi

[pprx]

next
edit "Serwer_Pocztowy"
set uuid 396ee918-a655-51ef-38e6-1432cc4067de
set extip xxx.xxx.xxx.xxx
set mappedip "xxx.xxx.xxx.xxx"
set extintf "wan1"
set portforward enable
set extport 12322
set mappedport 22
next
edit "Serwer_Pocztowy2"
set uuid 12ab179a-a7e8-51ef-cc4d-24bdab69d183
set extip xxx.xxx.xxx.xxx
set mappedip "xxx.xxx.xxx.xxx"
set extintf "wan1"
set portforward enable
set extport 1-65535
set mappedport 1-65535
set portmapping-type m-to-n
next
end

@Toshi_EsumiYes i meant SSH 22 port cause i need it to give it to my coworkers for installation on server, sorry

But I think problem will be the same with other ports when mail server will have to communite to internet through smpt and so on.

Here You have my 2 tries with it. On one i tried to Many to Many and SSH still is silent, on second i tried to map One to One, ofc it doesnt work.

diag sniffer packet any 'host x and port 22' 4
interfaces=[any]
filters=[host x and port 22]
400.716655 wan1 in x -> x.22: syn 3176200376
401.715800 wan1 in x -> x.22: syn 3176200376
403.714573 wan1 in x -> x.22: syn 3176200376
407.774874 wan1 in x -> x.22: syn 3176200376
415.784499 wan1 in x -> x.22: syn 3176200376
460.066594 wan1 in x -> x.22: syn 1068178477
461.102649 wan1 in x -> x.22: syn 1068178477
463.142497 wan1 in x -> x.22: syn 1068178477
467.084320 wan1 in x -> x.22: syn 1068178477
475.092478 wan1 in x -> x.22: syn 1068178477

Result of diag sniffer

[funkylicious]

Hi,

Can you try and activate NAT on the firewall policy ( WAN to LAN ) and/or disable firewall locally on the destination which you are trying to reach?

It seems that the destination is not returning any traffic which could mean that either it's default route isn't thru the FW ( NAT will solve the issue ) or the access is blocked locally on the server.

[Toshi_Esumi]

Did you sniff like "diag sniffer packet any 'host x(external IP)' 4 0"? It wouldn't show you the packets going out to the interface to get to the internal server. Because the destination IP it translated (VIP) to the internal server IP.

You need to sniff like
"diag sniffer packet any 'host x(external IP) or host y(server IP)' 4 0"

The VIP config seems to fine except you want to do "1-to-1" mapping for the range. My guess is the same as @funkylicious The FGT is forwarding them to the server but the server is ignoring.

Toshi