use different VIP according to source IP?

[wurtel]

I'm in the process of converting a Linux firewall at the office which had evolved over many years to a Fortigate setup.

I've used Fortigate for our hosting environment for a couple of years, so I'd not quite the newbie...

One thing we currently have set up is that incoming SSH connections get forwarded to an internal jump host, with the exception of incoming SSH connections from one particular IP address. I had expected that I could create a VIP address with a source IP filter for that address and have that go to a special internal host, and create another VIP address without a source IP filter that forwards the SSH connection to the jumphost. However it seems that the source IP filter is not considered when deciding whether the entry is a duplicate or not.

This is basically how it's done in the linux firewall with iptables:

iptables -t nat -A PREROUTING -s $special_ip -d $my_ip -p tcp --dport ssh -j DNAT --to-destination $specialhost
iptables -t nat -A PREROUTING                -d $my_ip -p tcp --dport ssh -j DNAT --to-destination $jumphost

 However I cannot figure out how to do this in my Fortigate. I could let ssh on the special host listen to an alternative port, which should work, but that's more of a kludge than a clean solution.

Is it at all possible?

[jintrah_FTNT · Accepted solution]

Hi Wurtel,

"I had expected that I could create a VIP address with a source IP filter for that address and have that go to a special internal host, and create another VIP address without a source IP filter that forwards the SSH connection to the jumphost."

You should be able to create entries with source filters defined. If you specify a source filter for one, you should specify for others too(defined for the same external ip) and not to leave one entry without any source filter with an expectation that it would match rest of the source addresses. Please see below sample,

config firewall vip
edit "test1"
set src-filter "33.33.33.1/32"
set extip 1.1.1.1
set mappedip "2.2.2.2"
set extintf "any"
next
edit "test2"
set src-filter "0.0.0.0-33.33.33.0" "33.33.33.2-255.255.255.255"
set extip 1.1.1.1
set mappedip "2.2.2.3"
set extintf "any"
next
end

Best regards,

Jin

[wurtel]

Thank you Jin for the implied hint that I should exclude the special IP from the source range of the "redirect the rest" VIP!

I was expecting that as long as the first VIP (with the special IP in the source filter) was matched first, the fall through should be enough for the rest; apparently not.

I do wonder though how efficient such IP ranges match. My feeling is that subnets would be faster as that can be checked with a bit-wise AND. I couldn't find anything in the documentation whether a range or a subnet is faster.

[ede_pfau]

to your last remark: selection speed is no concern here unless you deal with thousands of connection attempts per second on that VIP. Looks more like an academic question.

Now consider you need 3, 4, ... special source-dependent VIPs. This really will get kludgy.

In newer FortiOS like v6.2, v6.4 Fortinet introduced a 'negate' setting in some objects. This is CLI only. Get into your VIP setup in CLI (right-click in GUI, 'edit in CLI') and issue 'set ?' to see if this is possible in a VIP as well. I frankly don't know as this is not occurring often.