FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
chaithrar
Staff
Staff
Article Id 198285

Description


This article describes how to configure port forwarding using FortiGate Virtual IPs.

 

Scope

 

FortiGate.

Solution


Add Virtual IPs to enable port forwarding.

To forward TCP or UDP ports received by the FortiGate external interface to an internal server, follow these two steps.

 

  • Add a Virtual IP enabled with Port Forwarding.
  • Add a firewall policy with a virtual IP.

 

This example describes how to configure port forwarding to allow access to an internal Windows server PC with the Remote access protocol which uses the default port of 3389.

To add a virtual IP that forwards RDP packets.

 

  1. In 5.0, go to Firewall Objects -> Virtual IPs -> Virtual IPs.
  • In 5.2, go to Policy & Objects -> Objects -> Virtual IPs.
  • In 5.4, 6.0, 7.0, go to Policy & Objects -> Virtual IPs.
  1. Select 'Create New'.
  2. Add a name for the virtual IP.
  3. Select the External Interface. This will typically be the interface that connects the FortiGate to the Internet.
  4. Set the External IP Address using:
  • The FortiGate unit public IP.
  • A cable or DSL connection with a dynamic IP, using 0.0.0.0
  •  If the ISP provides a block of IPs that route to the FortiGate external interface, add one of these IPs here.
  1. Set Mapped IP Address to the internal IP address of the Windows Server PC.
  2.  Select 'Port Forwarding'.
  3. Set protocol to 'TCP'.
  4. Set 'External Service Port' and 'Map' to Port. For this example, the RDP service uses port 3389. Set both External Service Port and Map to Port to 3389.
  5. Select 'OK'.

vippp.PNG

 


Now all that’s left is to define a firewall policy that accepts RDP traffic from the Internet and forwards it to the internal Windows Server PC.

To add a firewall policy with a virtual IP.

 

  1.  In 5.0, Go to Policy -> Policy -> Policy.
  2. In 5.2, Go to Policy & Objects -> Policy -> IPv4.
  3.  In 5.4, 6.0, 7.0 Go to Policy & Objects -> IPv4 Policy.
  4.  Select 'Create New'.
  5.  Set 'Source Interface' to the WAN/Internet interface.
  6. Set 'Source Address' to 'all'.
  7.  Set 'Destination Interface' to 'internal'.
  8.  Set 'Destination Address' to the name of the virtual IP.
  9.  Usually, the remainder of the options in this firewall policy do not need to be changed. For example, service can remain 'ANY', because the virtual IP only forwards packets using port 3389.
  10. Select 'OK'.

 

 

vippppp.PNG