Telnet and Ping Blocked

[lucadclabs]

Good Morning, I have a problem I can not solve with my fortigate 110c. I would like to be able to make a tunnel between a company's internal server and multiple other servers outside of which I have the public IP. The customer's request is to open the port 22, 80 and 443. I have to be able to test efffettuare as a telnet on port 22 to one of the public IP they gave me to check the operation. I followed the guide and the video that explains how to do port forwarding but with negative results.

Could you help me please?

Thanks

[ede_pfau]

hello,

and welcome to the forums.

Can you show us what you have done so far? Which steps have you taken?

Do you have access to the documentation, especially the "FortiOS Handbook", chapter "firewalling".

Now, apart from the technical obstacles, you will know that opening standard ports on your internet facing interface is not a good idea at all. Why don't you just create an IPsec tunnel to the other network and then whatever service you need securely?

[lucadclabs]

I follow this guide:

http://docs-legacy.fortinet.com/cb/html/index.html#page/FOS_Cookbook/Firewall/cb-firewall-dnat3.html

With

I don't can access to external server and configuration of firewalles of those.

For this reason, it seems strange that I can do something .. But manager those servers tells me that I need to unlock something on my firewall. I created rules for both TCP and UDP ports on my firewall but they said that is not enough. I tried pinging their server but I did not respond.

Is it possible that my firewall block telnet to an external server?

[lucadclabs]

You're right .. I too have the same confusion..

Then i ask..for telnet on external servers I have to create some rule on my firewall?

Thanks for reply

[ede_pfau]

Hmmm, I have re-read your first post. Please clarify: are you trying to connect to an external server which has a public IP address, on port 22 (ssh), 80 (http) or 443 (https)?

And you ping'ed that server and it did not respond?

Generally, you don't have to set up a port forward just to enable outgoing connections. That's why I'm confused...please help me.

[ede_pfau]

Yes, you need a policy from 'internal' to 'wan', i.e. from your LAN's interface to the internet facing interface.

As addresses use 'all' in both places (source and destination).

As service use 'ALL' or 'ANY' whatever you have in the list.

Schedule is 'always'.

Then enable 'NAT'. This is most important.

Put this policy on top of all policies so that it will be matched first.

Test with pinging 8.8.8.8 from a host on your LAN. Then ping the external servers you are trying to reach.

If there is an answer you are good.

If not, it doesn't matter much.

Try to browse to the server with a browser (that is, use http or https on ports 80 or 443).

And then please post back.