my first post here, any help is appreciated. I have a fortigate 50E with a bunch of PCs connected to it which form my internal network. One of the PCs is running a web app (Confluence to be precise). I can access this app from within the internal network with . Now I'd like to be able to access it from the internal network using something like 'confluence.myoffice.com:someport'. I also have confluence.myoffice.com as subdomain with my webhoster, but which I don't expect to see if I open that url from my local network. I read about conditional port forwarding and set it up via the Fortigate CLI:

config system dns-database
    edit "my_forward"
        set authoritative disable
        set domain "confluence.myoffice.com"
        set forwarder "<myIP>"

and also set up the interface, so that in my Fortigate UI I see:

enter image description here

However when I open a browser on my internal network with confluence.myoffice.com it takes me to the public version. How can I check that the Fortigate settings are taking effect?

I followed @Zac67 instructions and have the following now:

enter image description here

but when I do nslookup from a machine in the LAN it still seems to go through the usual DNS:

enter image description here

This is what I get from the Fortigate console:

enter image description here

  • If the server is located in your LAN and you want to be able to address it by name you can just set up an appropiate entry (A record) on your local DNS server. This name doesn't need to exist on the Internet unless you want someone outside to use it.
    – Zac67
    Commented Nov 1, 2017 at 20:48
  • Your host will use whichever DNS server is configured in the host, usually by DHCP. It uses UDP to request the IP address of a DNS name from the configured DNS server. Traffic on the network has addresses, not DNS name for the source and destination on the packets. Configuring the DNS server on your router doesn't do much unless the hosts are configured to use it, rather than a different DNS server.
    – Ron Maupin
    Commented Nov 2, 2017 at 0:48

2 Answers 2


For local name resolution you need to set up 3 things:
1- a DNS zone
2- at least one A record in that zone
3- a DNS on the interface where your internal hosts are

A zone in a nameserver is a container for name/IP pairs, the records. You create a DNS zone in config system dns-database:

config system dns-database
    edit "MyCompanyZone"
        set status enable
        set domain "mycompany.local"
        set type master
        set view shadow
        set ttl 14400
        set authoritative enable
        config dns-entry
            edit 1
                set status enable
                set type A
                set ttl 0
                set hostname "namea"
                set ip
            edit 2
                set status enable
                set type A

This zone only holds records for your private hosts and thus it must be 'authoritative'!
Next, the record(s). They are created in the config dns-entry section. Record type 'A' denotes a host entry. It doesn't harm to have an additional 'NS' record with the name of your nameserver, i.e. the Fortigate.

Then you set up a DNS for your hosts to use, here on the 'lan' interface:

config system dns-server
    edit "lan"
        set mode recursive

# explanation for the mode parameter:  
# set mode
recursive        Shadow DNS database and forward.
non-recursive    Public DNS database only.
forward-only     Forward only.

As you can see, it must be in 'recursive' mode or non-local names will not be resolved. If the requested hostname is not found in the dns-database, if 'recursive' is specified the request will be forwarded to the Fortigate's System DNS which can be a Fortiguard DNS (like in your case) or your provider's DNS.

Now you can resolve a local hostname like 'namea.mycompany.local'.

At last, if you use the FGT as your DHCP server, specify the Fortigate's LAN address as the DNS to use so that all your local hosts will know whom to ask.

  • thank you! I followed your instructions to the letter, but it still doesn't work. I can only see my web app (confluence) on the server it is running on. Can you recommend a way to debug this?
    – hadron
    Commented Nov 2, 2017 at 12:01
  • Use "nslookup confluence.mycompany.local serverIPtoask" to debug. Specify the internal 'lan' interface address as 2nd argument. Check which DNS your host(s) are using. Commented Nov 2, 2017 at 12:10
  • The output from the Console looks perfect so you can assume the FGT is resolving correctly. Next is to check why the hosts are not. Commented Nov 2, 2017 at 12:14
  • it works! Had to restart my network connection (of course...). Marked as accepted answer, unfortunately don't have enough karma to upvote.
    – hadron
    Commented Nov 2, 2017 at 13:10
  • Glad I could help! Commented Nov 2, 2017 at 13:30

Apparently, you're using the FG for local DNS resolution. You can set it up to resolve the name to a LAN IP (replace

config system dns-database edit "my_entry" set authoritative disable config dns-entry edit 1 set hostname "confluence.myoffice.com" set ip next end next end

To check whether the entry works run (Windows) nslookup confluence.myoffice.com - it should turn up the LAN IP.

  • Thanks @Zac67, yes I'm using FG. I followed your instruction, (added 'ip' after your last set, otherwise I get an error) but it still doesn't work. confluence.myoffice.com:8090 times out. Is there anything I need to do on the web server side?
    – hadron
    Commented Nov 1, 2017 at 21:34
  • Added ip in my answer, thx. Have you set up a DNS zone?
    – Zac67
    Commented Nov 1, 2017 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.