FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
guptar
Staff
Staff
Article Id 196734

Description

This article describes port forwarding using FortiGate Virtual IPs.

Scope

FortiGate v6.2.x, 6.4.x,7.0.x,7.2.x,7.4.x

Solution

Create Virtual IPs to enable port forwarding:

 

To forward TCP or UDP ports received by the FortiGate external interface to an internal server, follow two steps:

  • Create a Virtual IP and enable Port Forwarding.
  • Create a firewall policy and add the Virtual IP.

 

This example describes how to configure port forwarding to allow RDP access to an internal server on port 3389.

To add a virtual IP that forwards RDP packets, follow the steps below.

 

VIP1.PNG

 

  1. For FortiOS 6.0.x,6.2.x,7.0.x,7.2.x,7.4.x, navigate to Policy & Objects -> Virtual IPs.
    1. Select Create New.
    2. Add a name for the virtual IP.
    3. Select the External Interface. This will typically be the interface that connects the FortiGate to the Internet. (Can leave as 'any').
    4. Set the External IP Address/Range. The following can be used:
  • The FortiGate unit public IP.
  • If there is a cable or DSL connection with a dynamic IP, it is possible to use 0.0.0.0. (Cannot user 0.0.0.0 when interface is 'any'). 
  • If the ISP provides a block of IPs that route to the FortiGate external interface, it is possible to add one of these IPs here.

 

  1. Set the Mapped IP Address to the internal IP address of the server.
  2. Select Port Forwarding.
  3. Set the protocol to TCP.
  4. Set External Service Port and Map to Port. For this example, the RDP service uses port 3389. Set both External service port and Map to Port to 3389.
  5. Select OK.

After, all that remains is to define a firewall policy that accepts RDP traffic from the Internet and forwards it to the internal server.

To add a firewall policy with a virtual IP:

 

RDP.PNG

  1. In 6.0, Go to Policy & Objects -> IPv4 Policy. In 6.4.x,7.0.x,7.2.x,7.4.x, Navigate to Policy & Objects => Firewall Policy.
  2. Select Create New.
  3. Set Source Interface to the WAN/Internet interface.
  4. Set Source Addresses to all.
  5. Set Destination Interface to internal.
  6. Set the Destination Address to the name of the Virtual IP created previously.
  7. Usually, the remainder of the options in this firewall policy does not need to be changed. For example, the Service can remain as ANY, because the virtual IP only forwards packets using port 3389. NAT can be enabled or disabled based on the network requirements. Some servers might not respond to RDP connection from a different network due to Windows/host-based firewall. NAT must be enabled in these cases.
  8. Select OK.

 

Note:

If 'External service port' and 'Map to IPv4 port' are different, both ports must be specified in the 'Service' field of the firewall policy (if it is not set to 'any'). 

 

11111.PNG 11111policy.PNG