Virtual IP for npm breaks my VPN

[kenschae]

I have a FortiGate 60F running firmware v7.4.3 build 2573.

It is connected to the Internet via the Wan1 interface. Wan1 is configured with a static IP address that I rent from my ISP. My firewall is configured to let the internal network go out to the Internet. 

I followed the documentation to add a split tunnel VPN so that I can RDP into my servers. It has worked great for a couple of years. 

Lat week, I added a Virtual IP and a policy to point to my NGINX Proxy Manager. To expose an HTTP site with an NPM cert to make it HTTPS. But when I activate the policy, it breaks the VPN.

Obviously, my knowledge is minimal at best. I would like to be able to expose a couple of web apps through NGINX and be able to continue to use RDP from the outside.

My goal is to learn, and to solve my problem:

1. Should I be looking at using the FortiGate as the reverse proxy? If so, where is the documentation for setting that up and how to have it generate certs the way that NPM does. NPM is super easy, but I am having a time figuring out how to get the FG to do it.

2. Is this a scenario where changing from the split tunnel to SPsec VPN is the way to use the Virtual IP and have VPN access at the same time?

3. Is what I am doing pretty complex and fraught with danger, to the extent that I should continue the classes on Fortinet training and come back to this later?

[AEK]

Is your VIP using the same IP as the one used by SSL-VPN?

If so, either NGINX uses the same port as SSL-VPN on the public IP, or in your VIP you mapped the whole IP to the internal NGINX IP.

So you should use different port. E.g.: use 443 in your VIP (port forwarding) for NGINX, and other port like 12443 for SSL-VPN.

[kenschae]

In VPN Settings, I have the VPN set to listen to 10443. The VPN firewall policy is set to the SSLVPNGroup and SLLVPN_TUNNEL_ADDR1 source with a 192.168.x.0/24 Destination and ALL services.  

In the firewall policy, I do have the VIP going from All sources to the NPM server destination. But the service is set to HTTP, HTTPS, and I added a service HTTP_81 for the port 81 that NPM uses for admin.

[ezhupa]

Hello,

You can try to configure VIP port forwarding on the VIP configuration as per the below document so the VIP matches only for specific ports and not for all ports on the WAN public IP address.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configurati...

It is possible that the VIP config is causing issues with the SSL VPN since the VIP is listening on all ports on the WAN IP. (including SSL VPN port 10443).

Hope this helps!

[kenschae]

This does seem to be my issue. I see that the Port Forwarding external service port allows for either a single port or range of ports. Is the best practice to create VIP for each port (80, 8080, 443, 81, etc.) or is there a way to enter all of the ports I want into that field?

[AEK]

You need to create one VIP for each. You can then put them in a VIP group if needed.

[kenschae]

Thank you for the link to the documentation. Learning how it works is just as important and fixing the problem. :)  

[AEK]

Can you share VIP config?

[kenschae]

Based on some of the other answers, it looks like I need to add port forwarding to the definition.

[alwis · Accepted solution]

Hi @kenschae 

Thank you for contacting Fortinet Support Forum.

If i understand correctly your query.

For RDP you will use SSLVPN to your server and you have Virtual IP and a policy to point to your  

NGINX Proxy Manager.

Did your VIP object is Port Forward or Static Nat? If you want to allow HTTPS and HTTP you just need to allow the port on the VIP object.  If you enable static nat  all  traffic from your public ip will be redirect to your NGINX Proxy Manager. If possible share your respective VIP object configuration.

Regards

Alwis