nat hairpin does not work

[FWY001]

Hi everyone, I have a LAN user wants to connect to a LAN server from the public address that is in the same subnet as the fortigate external address. I have setup VIP and firewall policies but it does not seem to work, debug flow shows it was DNATed to the server's internal address but the traffic does not go through(my server does not receive any traffic), the final log of the pakcet was "allowed by policy" then followed with nothing. My topo and configs are as follow, any idea is appreciated.

config firewall vip
edit "vip"
set extip "10.1.1.2"
set mappedip "192.168.8.200"
set extintf "wan" # have tried with "any" but also not working
set portforward enable
set extport 443
set mappedport 443

config firewall policy
edit 1
set name "lan1-to-lan2"
set srcintf "lan1"
set dstintf "lan2"
set action accept
set srcaddr "all"
set dstaddr "vip"
set schedule "always"
set service "ALL"
edit 2
set name "wan-to-lan2"
set srcintf "wan"
set dstintf "lan2"
set action accept
set srcaddr "all"
set dstaddr "vip"
set schedule "always"
set service "ALL"
edit 3
set name "lan2-to-wan"
set srcintf "lan2"
set dstintf "wan"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set nat enable
edit 4
set name "lan1-to-wan"
set srcintf "lan1"
set dstintf "wan"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set nat enable

[FWY001]

the topology is here

[sjoshi]

Hi FWY001,

Please refer and follow below article for Hairpin NAT.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-Hairpin-NAT-VIP/ta-p/195448

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-hairpins-with-a-server-application-t...

[FWY001]

Hi, I followed example 1 in the 1st link, but it does not work

[sjoshi]

The config looks fine

Please verify if any policy route is in place

Also try to collect debug flow

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/54688/debugging-the-packet-f...

[FWY001]

Hi, debug flow shows "DNATed" to the internal server, and after several policy matches(all act-accept), it shows "Allowed by policy N:" and then the packet ends, N being the wan-to-lan2 policy, didnt receive any traffic checking my server's access log.

[sjoshi]

did u confirm of any policy route?

[dingjerry_FTNT]

Hi @FWY001 ,

Please try the following:

1) In VIP settings, set the external interface to "any";

2) Disable firewall policy 1, or remove the VIP as the destination address in policy 1 (use all instead).

[FWY001]

Hi, tried but still the same

[FWY001]

For some reason I can access this server with the public ip from LAN2 (LAN2 hairpin to LAN2, not with LAN1) before, I checked debug flows the difference is previously the last 2 logs are "Allowed by policy-N: SNAT" and "SNAT: 192.168.8.100 -> 192.168.2.1", no idea what I have changed caused this difference.