Traffic blocked by implicit Deny

[jd653687]

My fortigate 100d is not forward traffic between Guestlan and lan.

Guestlan is on a seperate lan.

Wan adresses are 200.200.200.2 255.255.255.240

One webserver is on 200.200.200.3 and traffic is going fine. From the internet as from the guestnetwerk

the second webserver is on 200.200.200.2

From the internet this website is accessable. But when we try to acces the website from the guestnewerk it is not accessable. When we look at the log and report we see it is getting in the Implicit Deny rule.

The guest network is 192.168.1.1 and external adres is 200.200.200.13. We have internet acces and eveything is working fine.

When I put the webserver from 200.200.200.2 to 200.200.200.4 it is working fine. When I change this back to 200.200.200.2 it stops working. Is this a bug because we use the first address in the range.

https on the webinterface is not enabled.

System settings https port 443 is changed to 8443 for Administration logon.

Please assist

[jd653687]

Hi Br,

Using VIP for the webserver.

[jd653687]

It is secondary address.

VIP

Name HTTPS-VIP

HTTPS 200.200.200.2 --> 192.168.10.2 (TCP 443--> 443)

Policy

Incoming wan1

Outgoing Lan

Source All

Destenation HTTPS-VIP

Schedule always

Service HTTPS

Action Accept

NAT off

Traces .

 id=20085 trace_id=199 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55212->200.200.200.2:443) from GuestLan. flag , seq 3301314164, ack 0, win 8192" id=20085 trace_id=199 func=init_ip_session_common line=4935 msg="allocate a new session-00a7e0ff" id=20085 trace_id=199 func=fw_pre_route_handler line=182 msg="VIP-192.168.10.2:443, outdev-unkown" id=20085 trace_id=199 func=__ip_session_run_tuple line=2808 msg="DNAT 200.200.200.2:443->192.168.10.2:443" id=20085 trace_id=199 func=vf_ip_route_input_common line=2584 msg="find a route: flag=04000000 gw-192.168.10.2 via lan" id=20085 trace_id=199 func=fw_forward_handler line=691 msg="Allowed by Policy-10:" id=20085 trace_id=199 func=ids_receive line=253 msg="send to ips" id=20085 trace_id=200 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.10.2:443->192.168.1.87:55212) from lan. flag [S.], seq 1870954775, ack 3301314165, win 8192" id=20085 trace_id=200 func=resolve_ip_tuple_fast line=4848 msg="Find an existing session, id-00a7e0ff, reply direction" id=20085 trace_id=200 func=vf_ip_route_input_common line=2584 msg="find a route: flag=04000000 gw-192.168.1.87 via GuestLan" id=20085 trace_id=200 func=ids_receive line=253 msg="send to ips" id=20085 trace_id=200 func=__ip_session_run_tuple line=2794 msg="SNAT 192.168.10.2->200.200.200.2:443"

[jd653687]

200.200.200.4 has no VIP only outgoing traffic, not inbound.

This seems the problem :

func=__ip_session_run_tuple line=2808 msg="DNAT 200.200.200.2:443->192.168.10.2:443"

func=fw_forward_dirty_handler line=359 msg="blocked by forwarding policy (Guestlan-> lan), drop"

[jd653687]

Extra debug info

diag debug flow filter saddr 192.168.1.87 diag debug flow filter port 443 diag debug flow show console enable diag debug flow trace start 100 diag debug enable

FGTHN # id=20085 trace_id=5654 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55308->200.200.200.2:443) from GuestWifiLan. flag , seq 2598153898, ack 0, win 8192" id=20085 trace_id=5654 func=init_ip_session_common line=4935 msg="allocate a new session-00aaee95" id=20085 trace_id=5654 func=fw_pre_route_handler line=182 msg="VIP-192.168.10.2:443, outdev-unkown" id=20085 trace_id=5654 func=__ip_session_run_tuple line=2808 msg="DNAT 200.200.200.2:443->192.168.10.2:443" id=20085 trace_id=5654 func=vf_ip_route_input_common line=2584 msg="find a route: flag=04000000 gw-192.168.10.2 via lan" id=20085 trace_id=5654 func=fw_forward_handler line=691 msg="Allowed by Policy-10:" id=20085 trace_id=5654 func=ids_receive line=253 msg="send to ips" id=20085 trace_id=5655 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55308->200.200.200.2:443) from GuestWifiLan. flag [.], seq 2598153899, ack 3445026833, win 17520" id=20085 trace_id=5655 func=resolve_ip_tuple_fast line=4848 msg="Find an existing session, id-00aaee95, original direction" id=20085 trace_id=5655 func=__ip_session_run_tuple line=2808 msg="DNAT 200.200.200.2:443->192.168.10.2:443" id=20085 trace_id=5655 func=ids_receive line=253 msg="send to ips" id=20085 trace_id=5656 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55308->200.200.200.2:443) from GuestWifiLan. flag [.], seq 2598153899, ack 3445026833, win 17520" id=20085 trace_id=5656 func=resolve_ip_tuple_fast line=4848 msg="Find an existing session, id-00aaee95, original direction" id=20085 trace_id=5656 func=__ip_session_run_tuple line=2808 msg="DNAT 200.200.200.2:443->192.168.10.2:443" id=20085 trace_id=5656 func=ids_receive line=253 msg="send to ips" id=20085 trace_id=5657 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55308->200.200.200.2:443) from GuestWifiLan. flag [.], seq 2598154086, ack 3445028293, win 17520" id=20085 trace_id=5657 func=resolve_ip_tuple_fast line=4848 msg="Find an existing session, id-00aaee95, original direction" id=20085 trace_id=5657 func=__ip_session_run_tuple line=2808 msg="DNAT 200.200.200.2:443->192.168.10.2:443" id=20085 trace_id=5657 func=fw_forward_dirty_handler line=359 msg="blocked by forwarding policy (GuestWifiLan->lan), drop" id=20085 trace_id=5658 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55308->200.200.200.2:443) from GuestWifiLan. flag [.], seq 2598154086, ack 3445029753, win 17520" id=20085 trace_id=5658 func=resolve_ip_tuple_fast line=4848 msg="Find an existing session, id-00aaee95, original direction" id=20085 trace_id=5658 func=__ip_session_run_tuple line=2808 msg="DNAT 200.200.200.2:443->192.168.10.2:443" id=20085 trace_id=5659 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55308->200.200.200.2:443) from GuestWifiLan. flag [.], seq 2598154086, ack 3445031213, win 17520" id=20085 trace_id=5659 func=resolve_ip_tuple_fast line=4848 msg="Find an existing session, id-00aaee95, original direction" id=20085 trace_id=5659 func=__ip_session_run_tuple line=2808 msg="DNAT 200.200.200.2:443->192.168.10.2:443" id=20085 trace_id=5660 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55308->200.200.200.2:443) from GuestWifiLan. flag [.], seq 2598154086, ack 3445032264, win 16469" id=20085 trace_id=5660 func=resolve_ip_tuple_fast line=4848 msg="Find an existing session, id-00aaee95, original direction" id=20085 trace_id=5660 func=__ip_session_run_tuple line=2808 msg="DNAT 200.200.200.2:443->192.168.10.2:443" id=20085 trace_id=5661 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55308->200.200.200.2:443) from GuestWifiLan. flag [.], seq 2598154086, ack 3445032264, win 16469" id=20085 trace_id=5661 func=resolve_ip_tuple_fast line=4848 msg="Find an existing session, id-00aaee95, original direction" id=20085 trace_id=5661 func=__ip_session_run_tuple line=2808 msg="DNAT 200.200.200.2:443->192.168.10.2:443" id=20085 trace_id=5662 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55308->200.200.200.2:443) from GuestWifiLan. flag [.], seq 2598154086, ack 3445032264, win 16469" id=20085 trace_id=5662 func=resolve_ip_tuple_fast line=4848 msg="Find an existing session, id-00aaee95, original direction" id=20085 trace_id=5662 func=__ip_session_run_tuple line=2808 msg="DNAT 200.200.200.2:443->192.168.10.2:443" id=20085 trace_id=5663 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55308->200.200.200.2:443) from GuestWifiLan. flag [.], seq 2598154086, ack 3445032264, win 16469" id=20085 trace_id=5663 func=resolve_ip_tuple_fast line=4848 msg="Find an existing session, id-00aaee95, original direction" id=20085 trace_id=5663 func=__ip_session_run_tuple line=2808 msg="DNAT 200.200.200.2:443->192.168.10.2:443" id=20085 trace_id=5664 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55308->200.200.200.2:443) from GuestWifiLan. flag [.], seq 2598154086, ack 3445032264, win 16469" id=20085 trace_id=5664 func=resolve_ip_tuple_fast line=4848 msg="Find an existing session, id-00aaee95, original direction" id=20085 trace_id=5664 func=__ip_session_run_tuple line=2808 msg="DNAT 200.200.200.2:443->192.168.10.2:443" id=20085 trace_id=5665 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55308->200.200.200.2:443) from GuestWifiLan. flag [.], seq 2598154086, ack 3445032264, win 16469" id=20085 trace_id=5665 func=vf_ip_route_input_common line=2584 msg="find a route: flag=80000000 gw-200.200.200.2 via root" id=20085 trace_id=5665 func=ip_session_core_in line=5361 msg="no session matched" id=20085 trace_id=5666 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55308->200.200.200.2:443) from GuestWifiLan. flag [.], seq 2598154086, ack 3445032264, win 16469" id=20085 trace_id=5666 func=vf_ip_route_input_common line=2584 msg="find a route: flag=80000000 gw-200.200.200.2 via root" id=20085 trace_id=5666 func=ip_session_core_in line=5361 msg="no session matched" id=20085 trace_id=5667 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 192.168.1.87:55308->200.200.200.2:443) from GuestWifiLan. flag [R.], seq 2598154300, ack 3445032264, win 0" id=20085 trace_id=5667 func=vf_ip_route_input_common line=2584 msg="find a route: flag=80000000 gw-200.200.200.2 via root" id=20085 trace_id=5667 func=ip_session_core_in line=5361 msg="no session matched"  

[emnoc]

You need a hairturn vip so how is the vip configured ( with regards to interface )

e.g 

config firewall vip 

    edit "AHAIRTURN_VIP"

        set extip 1.1.1.1

        set extintf "any"    <-----HERE

        set mappedip "192.0.2.1"

    end

If you have a defined "interface" that vip is tied just to that interface & you can have ONLY  one interface or "ANY" for the VIP.

Please share the VIP configuration from the cli 

eg

show firewall vip <vip_name>

[jd653687]

Thank you so far.

I will try the ANY option as you wrote.

This is the VIP

GTHN # show firewall vip config firewall vip     edit "HTTPS-"         set extip 200.200.200.2         set extintf "wan1"         set portforward enable         set mappedip "192.168.10.2"         set extport 443         set mappedport 443     next

[jd653687]

Changed it to:

        set extip 200.200.200.2         set extintf "any"         set portforward enable         set mappedip "192.168.10.2"         set extport 443         set mappedport 443

But still not working.

[emnoc]

Qs:

[ul]

did  you run dig debug flow 

did you ensure the fwpolicy rule is correct

is the client using a split EXT/INT DNS[/ul]

[ede_pfau · Accepted solution]

There's more to a hairpin VIP, read here: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36202

But I agree, @emnoc's got it.