Site to Site Fortigate private network over IPSEC, Allow SMTP outbound from single device

[Wayupnorthguy]

I have a private point to point network over IPSEC VPN.  I'm trying to allow only SMPT sendmail service from a single client on one end to a host on the Internet via the WAN interface.  I've created an outbound FW rule to allow SMTP port 25 to a FQDN (smtp.gmail.com) from the internal client with NAT enabled using the outside WAN interface IP.  I've also created an inbound rule allowing ALL traffic from smtp.gmail.com to that specific client.
I can telnet from the CLI to port 25 on the smtp server but I cannot do the same from the client.
I've enabled and disabled NAT on the inbound side with same results.
I'm pretty new to Fortigate but have experience with other firewall and policy products.

[Wayupnorthguy]

id=20085 trace_id=201 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=6, 192.168.20.2:59626->74.125.142.108:25) from internal5. flag [S], seq 3700941528, ack 0, win 64240"
id=20085 trace_id=201 func=init_ip_session_common line=5898 msg="allocate a new session-0117c771"
id=20085 trace_id=201 func=vf_ip_route_input_common line=2621 msg="find a route: flag=04000000 gw-xxx.xxx.xxx.xxx via wan1"
id=20085 trace_id=201 func=fw_forward_handler line=643 msg="Denied by forward policy check (policy 0)"
id=20085 trace_id=202 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=6, 192.168.20.2:59626->74.125.142.108:25) from internal5. flag [S], seq 3700941528, ack 0, win 64240"
id=20085 trace_id=202 func=init_ip_session_common line=5898 msg="allocate a new session-0117c77c"
id=20085 trace_id=202 func=vf_ip_route_input_common line=2621 msg="find a route: flag=04000000 gw-xxx.xxx.xxx.xxx via wan1"
id=20085 trace_id=202 func=fw_forward_handler line=643 msg="Denied by forward policy check (policy 0)"
id=20085 trace_id=203 func=print_pkt_detail line=5727 msg="vd-root:0 received a packet(proto=6, 192.168.20.2:59626->74.125.142.108:25) from internal5. flag [S], seq 3700941528, ack 0, win 64240"
id=20085 trace_id=203 func=init_ip_session_common line=5898 msg="allocate a new session-0117c78a"
id=20085 trace_id=203 func=vf_ip_route_input_common line=2621 msg="find a route: flag=04000000 gw-xxx.xxx.xxx.xxx via wan1"
id=20085 trace_id=203 func=fw_forward_handler line=643 msg="Denied by forward policy check (policy 0)"

[Wayupnorthguy · Accepted solution]

I found that the FQDN address that I created resolved to a different IP then what I was using in the Telnet command.  When I changed that I was able to connect.  Bottom line is that if you have a client that cannot resolve addresses due to DNS being blocked...you have to use the known IP and that IP has to match the FQDN....or don't use FQDN and just put the IP address in.  Live and Learn.

[aionescu]

Hi @Wayupnorthguy great to hear the issue is fixed and everything is working as expected now.

[Wayupnorthguy]

Thanks for your help in the diagnosis.  Tools I shall not forget anytime soon.