Setting up a Dual NAT

[DaveK]

So let me preface that I'm not a Network guy... but I've been given the opportunity to dive in and learn with some stuff at home.  One of those items is a Fortigate 60E that I'm going to sort of build my home lab behind (generally by trade I'm a VMWare guy).     In the temporary, as this is on my primary home connection for the foreseeable future, I need to setup a double NAT type setup like the link below:   https://chasechristian.com/blog/2016/04/consoles-enterprise-firewalls-and-upnp/   Essentially because I have kids, etc, and need to start "working" and tune as I learn I want to put the 60E on my edge so it can scan traffic, etc, and do its edge job... but then let the inside be a bit more squishy like my traditional home router so their XBOX's, apps, etc, all work immediately... and I can tune the entire design as I become more proficient.   Can someone potentially point me on essentially creating the double NAT rule on the Fortigate 60E that passes all traffic to my router IP so I can get things working?     I'm anxious to learn as I've always been a fan of knowing end to end (always better for your job, and just good to know) and this is the first step for me on the Network side.   THANK YOU!

MOD:  You can close the thread in the ROUTING forum as its likely a better spot here.

[ede_pfau]

hi,

and welcome to the forums!

You'll find plenty of fellows here just starting into the Fortinet world so no need to apologize (except maybe for using SRXes...). Your plan sounds interesting, and is easy as pie to set up.

First off, to put the FGT at front towards your ISP is a wise decision. It needs a routable public address on it's WAN port, for authenticating against the FortiGuard servers for continuous UTM signature updates (and much more other stuff). So, I was relieved to see this.

Now the steps to set it up:

1- the FGT is configured to autheticate against your ISP via the 'wan1' port - DHCP, PPPoE, static address, whatever.

2- you make sure there is a default route pointing to the ISP's gateway (that is, destination '0.0.0.0/0'). DHCP and PPPoE deliver this automatically.

3- the internal ports only cater for a 'transfer net'. Any private address range will do, so like 172.16.x.1/24 or 192.168.x.1/24. This will be the (static) address of the 'internal' port(s). There is room for 253 other addresses but you will only need one other.

4- to make things easy configure a DHCP server on port 'internal' if it doesn't exist yet. This will assign a valid address, the gateway, the DNS and even the NTP server address if you like, to any host connecting to the 'internal' port and using DHCP requests.

In your case, this host will be the home router, more specifically, it's WAN port. Configure it to use DHCP.

5- Where is the double NAT? In the policy!

So now you create a policy on the FGT, from 'internal' to 'wan1', addresses 'all' to 'all', service 'ANY', NAT enabled, UTM enabled (at least AV). This will do the private transfer net-to-public NAT. Your home router will do the second NAT plus the Upnp stuff, like before.

So, in short, remember that in order to have traffic flowing across the FGT it needs

- both a route to the source and to the destination

- a policy connecting the inbound and outbound ports

Look up the current routes in Monitor/Routing. The FGT automatically creates a route for each subnet which is directly connected to one of it's ports. And for unknown destinations, there is the default route.

Your home router gets his gateway address through DHCP from the FGT - it's the address of the 'internal' port.

As the home router is NATting, the FGT doesn't need to know your true internal address space behind the home router.

This description seems a bit bloated, I apologize. I wanted to make sure you get it right the first time. The setup will take you less time than needed to read this. If you encounter any problems let us know.

[DaveK]

Ede,

  That is some EXTREMELY helpful information!

I'm going to give it a run through in a few mins, after I convince the kids its okay to have no internet for 15mins, and see if I can get it working.

Regardless if I figure it out or not that's one hell of a welcome, and some GREAT information!  Thank you!

I'll let you know how it goes in a bit.

[DaveK]

Question:  Do I need to create a WAN to INTERNAL policy as well to accept traffic coming back and push it all to the router, or does the ANY/ANY from Internal to WAN cover that?

[Fullmoon]

DaveK wrote:

Question:  Do I need to create a WAN to INTERNAL policy as well to accept traffic coming back and push it all to the router, or does the ANY/ANY from Internal to WAN cover that?

No need to create WANx-Internal policy/rule. FortiGate is a Statefull firewall. 

[DaveK]

Thanks!  I thought so, after doing some tweaking to be sure, but wanted to ask.

So far so good.  Easy as pie to setup as mentioned above, steps were 100% easy to follow, and so far things are going good. 

I appreciate the help!