1

I'm using a Fortinet 311B firewall and having an issue understanding why this traffic is being blocked.

There is an access rule and matching NAT statement for an external IP address pointing to an internal web server. External users (via the Internet) can access this website with no problem.

Internal users are using internal DNS, which resolves the same hostname to a private IP address, providing direct access to the website, and this works normally.

Wireless users, connected via FortiAP and coming into the Fortinet on a separate "wireless" interface, have a completely separate subnet and are not allowed any LAN access; Internet only. When they attempt to connect to the website host address, it fails. Since they are Internet only, they are using external DNS and resolving the outside IP address. This outside IP address of the web server is a virtual IP on the Fortinet attached to the External interface, with a 1-to-1 NAT to the internal web server.

I've tried creating ACL entries to allow traffic from the wireless interface to the External interface, and even a "NAT 0" rule for this traffic, but I'm wondering if there is some other security feature at work here, as I know firewalls don't necessarily like this sort of "hairpin" traffic. I've checked the logs and I'm not seeing any of my interesting traffic show up.

Anyone have any ideas?

Improve this question
8
  • It does sound like the hairpin problem. If you have nothing in the logs, it's likely that the traffic from the Wi-Fi clients is just being normally routed out the default route to the Internet.
    – Ron Maupin ♦
    Oct 14, 2015 at 22:57
  • Yea, so the traffic would be destined for the External security zone, but the next hop would be the device itself, so it shouldn't be "sent" out the external interface right? That's where I'm having a hard time understanding what the firewall is (or should be) doing in this case.
    – Matt
    Oct 14, 2015 at 23:08
  • It the server just sitting naked on the Internet, or is it connected to the firewall on an interface other than the interface for the Internet?
    – Ron Maupin ♦
    Oct 14, 2015 at 23:10
  • The internal web server is on the internal network, behind the firewall. The external IP is a VIP on the firewall with a one-to-one NAT statement to the internal IP. In other words, pretty standard internal web server config.
    – Matt
    Oct 14, 2015 at 23:14
  • Your traffic coming from the Wi-Fi clients is probably being directly routed out to the Internet. The traffic is not being blocked as you wrote in the question; it never has the chance to get blocked. Once it hits the Internet interface, it is going out, not coming in. Firewall and NAT rules are directional; an outbound packet doesn't get the inbound rules applied.
    – Ron Maupin ♦
    Oct 14, 2015 at 23:34

1 Answer 1

Reset to default
1

This is a pretty common problem on a lot of stateful firewalls (SRXs and ScreenOS will do this as well).

The issue is that traffic from your wireless interface/zone will be routed out the Internet Zone/Interface, but not to the NAT.

On the SRX at least, you need to configure the NAT so that it is available on the wireless interface (as if it was another Internet-facing interface) and then the inbound traffic from your wireless interface will be destination NATted before the routing decision is made and then routed to the "LAN" interface.

I would be very surprised if Fortinet didn't require something similar.

Improve this answer
3
  • So, what you're saying is that I should match the traffic coming in on the wireless interface with an ACL, and translate the destination to the internal IP. That's a great idea, I knew there was something I wasn't thinking of! I didn't see the option on the ACLs i was creating, but there's gotta be a way to do that on the Fortinet. Thanks, I'll try it tomorrow and see if it works.
    – Matt
    Oct 15, 2015 at 5:32
  • Unfortunately, it seems I can't do this on the Fortinet. Fortinet accomplishes destination address translation by using a Virtual IP address, which maps an external address to an internal address. The problem is that you can only define one VIP for an IP address, and the VIP has to be associated with one interface. The existing VIP is using the external IP address and is associated to the external interface. If only I could associate this VIP to the wireless interface as well, but it will not allow me to do this.
    – Matt
    Oct 15, 2015 at 15:38
  • 1
    Success! I was able to edit the VIP and change it's associated interface from 'port 10 - External' to 'Any' and then I could use it as a destination in any policy rule. Created a policy rule From Interface:SSID-Guest To Interface:Internal From Address:Any To Address:VIP-WebServer NAT:Enabled (Use Destination Interface Address) and it is working! Thanks a lot Benjamin and Ron for your help.
    – Matt
    Oct 15, 2015 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.