Please make sure you do not NAT Port 20443 on the Primary IP Address.
When creating a Destination NAT rule (DNAT), you first need to create a 'Virtual IP'. This is a mapping of Public IP to Private IP.
Virtual IP's can be in either 1 to 1 mapping (Public to Private), or 1 to Many (Port Forwarding) configurations.
In a port forwarding configuration, you can use a single public IP address to give access to multiple private IP addresses, on different ports. This saves you from having to purchase multiple IP addresses in many cases (such as if you run a hypervisor).
Examples
Below is a simple example of 1:1 NAT:
27.50.127.2 -> 192.160.0.2
In 1:1 NAT, the Firewall policy is used to only allow access to specific ports.
Below is a simple example of 'Port Forwarding':
27.50.123.2:3389 -> 192.168.0.2:3389
27.50.123.2:3390 -> 192.168.0.100:3389
27.50.123.2:3391 -> 192.168.0.250:3389
Notice how the Public IP Address remains the same and we're simply specifying Ports, whilst on the 'Private' side each destination is unique.
Configuring Virtual IPs
In this example, we have a Public IP Address of 27.50.123.2, which is part of one of our existing IP pools. We also have a server behind our firewall on a private IP address 192.168.0.2.
The goal of this example DNAT rule is to allow our users to connect Remote Desktop (RDP) on 192.168.0.2 via the Public IP Address 27.50.123.2 on a Custom RDP port 29292.
The final NAT rule will visually look like this:
27.50.123.2:29292 -> 192.168.0.2:3389
In other words, when a user enters "27.50.123.2:29292" into their RDP client, it will forward the connection to 192.168.0.2:3389, allowing the user to connect to the default RDP port (3389) on our server's private IP (192.168.0.2).
How to create a new Virtual IP
- Log into your Fortigate Firewall with the credentials you've been supplied:
2. Navigate to 'Policy & Objects', then ' DNAT & Virtual IPs' , then under the 'Virtual IP' tab click '+ Create New'
We can then proceed on to configuring below.
How to Configure the Virtual IP
Please refer to the below image in reference to the corresponding numbered instructions:
- Enter a name for your Virtual IP (DNAT) policy. Make it as descriptive as possible so you can easily identify it later.
- Enter the external IP address. This is the IP which external/internet users will access.
- Enter the internal/private IP address which is the final destination of the traffic.
- If you're doing Port Forwarding (not 1:1 NAT), tick Port Forwarding, and then choose the Protocol of the ports you wish to forward.
- Choose the Port of the external IP Address. In this example we're translating Port 29292 to Port 3389 so we want 29292 on the Public/External side.
- Set the Port which the service is listening on, on the private IP address. In this example we're trying to provide access to Remote Desktop (RDP) which listens on port 3389 by default.
- Click OK once you've completed the configuration.
By default, all incoming traffic is denied, so you won't be able to access the services on the Virtual IP address until you create specific Firewall Policies for it!