Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
junnian
New Contributor

can not reach outside from DMZ

fortigate80, NAT

everything works fine, except DMZ.

 

what I done:

set up VIP.

configure DMZ interface as different subnet from Internal subnet.

set up firewall policy between DMZ <=> Internal , Internal => WAN, and DMZ <=> WAN.

in DMZ subnet, no DHCP, no DNS. the linux workstation in DMZ has static IP and publice DNS address info.

 

communication between DMZ and Internal has no problem. Internal can communicate to WAN. the workstation in DMZ can be reached from internet( WAN) through VIP. but DMZ can NOT get to internet.

 

the static route looks ok, otherwise Internal can not communicate to WAN, but DMZ still can not be routed to internet. After I put a policy route for “incoming interface" is DMZ, then DMZ can go through internet.

 

My understanding is that "policy route" should be unnecessary, am I right? or I did something wrong.

 

Thanks for any directing.

 

Jun

5 REPLIES 5
ede_pfau
SuperUser
SuperUser

hi,

 

and welcome to the forums.

My first idea was that there is no (correct) default route on the DMZ host. But in this case traffic from WAN to DMZ host wouldn't work. Can you confirm that?

 

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
rwpatterson
Valued Contributor III

Also often overlooked is to use the NAT check box on any interface that is passing traffic to the public Internet.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
junnian

like I said, I did set up VIP to the DNZ subnet workstation. And I can reach the DMZ subnet workstation with SSH from outside our office. is this VIP mapping function similar with policy routing?

ede_pfau

No. Routing directs traffic to interfaces and/or next hop routers (by substituting destination addresses). VIPs do destination NAT but do not select paths.

Without some more infos on the setup solving this will be difficult.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
jpplante
New Contributor II

Sounds like you may have a NAT issue.  Make sure you setup NAT for DMZ traffic out.  

 

Also just a side note are you really sure you want to setup full two way traffic between DMZ and LAN?  Technically that is doing nothing to protect your LAN from the computer in the DMZ.  To make matters worse you have opened your DMZ to WAN.  According to the detail unless of course I am reading it wrong you are allowing a would be attacker to use the DMZ as a hop directly into your LAN.

 

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors