Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
junglecom
New Contributor

Source IP passthrough to nat clients

Hi All, I am NATing 2 servers through a fortigate firewall. Internet | Fortigate (NAT) | | VM1 VM2 When I check the access logs on the servers being NATed (VM1, VM2) all the traffic has the source IP of the fortigate server. How can I make it so the original source IP is sent down the NAT to the destination servers? Thank you
16 REPLIES 16
emnoc
Esteemed Contributor III

Since your all over with posting this same problem; - create one default route to this port Remove that 2nd route, remove your check NAT enable block and you should be golden.

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
junglecom
New Contributor

Thanks everyone for your input! Please let me start over here, since I still am unable to get this working. Below is all my settings simplified. Anyone see what I am missing here? Thank you very much for your help!
emnoc
Esteemed Contributor III

like the other thread

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
junglecom
New Contributor

Sorry I started my config over removing all unnecessary IPs, since I still am unable to get this working. Below is all my settings simplified (reposted). Anyone see what I am missing here? Thank you very much for your help! (VIP Updated)
junglecom
New Contributor

Sorry for being a nitwit here but figured out the issue. Rule number #1 of IT: Always check the firewall of the server first. My co-worker, unknown to me, had set iptables to only accept traffic from fortigate private ip address. This is why i could access with incoming NAT turned on and not with it OFF. Cause the source IP would change to the original public IP of the source traffic. Thank you all for your help with this.
ede_pfau
SuperUser
SuperUser

wow, what a real blooper! Hope you told him some...
Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
danielsuarez

And 6 years later, I carefully followed this post since I was facing the exact same problem, just to realize my local resource was also only allowing traffic from the FortiGate private address. So, thank you junglecom, haha.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors