---
title: "Configure port forwarding"
sidebar_label: "Configure port forwarding"
sidebar_position: 7
description: "How to configure port forwarding to access servers behind a firewall"
---

import Formbricks from '@theme/MDXComponents/Formbricks';

import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
import { TabItemLabel } from '@selectel/docux/components';

# Configure port forwarding

:::info

This manual provides instructions for configuring port forwarding on a firewall to access servers via SSH.

:::

Для доступа к серверу за межсетевым экраном можно настроить переадресацию портов (port forwarding). Это позволяет подключаться к серверу по публичному IP-адресу межсетевого экрана без необходимости знать приватный адрес сервера. Пользователи будут подключаться к серверу только по тем портам, которые вы укажете in настройках.

The settings in this manual are relevant for FortiOS 6.x and 7.x versions. If you are using a different version of FortiOS, you can find the documentation for it in the FortiGate control panel in the upper right corner or on the [official FortiGate website](https://docs.fortinet.com).

To configure port forwarding:

1. [Create a virtual IP address](#create-virtual-ip).
2. Optional: [create a virtual IP address group](#create-virtual-ip-address-group).
3. [Create a security policy](#create-security-policy).

## 1. Create a virtual IP address \{#create-virtual-ip}

A virtual IP address maps the public address of the firewall to a private address of a server behind the firewall. When a user tries to connect using the public address, FortiGate redirects the request to the required server.

<Tabs queryString="create-virtual-ip">
  <TabItem value="graphic">
    <TabItemLabel>
      Graphical interface
    </TabItemLabel>

    <Tabs queryString="firmware">
      <TabItem value="fortios-6">
        <TabItemLabel>
          FortiOS 6.x
        </TabItemLabel>

        1. [Connect to the firewall](/firewalls/fortigate/connect-to-firewall.mdx).

        2. Go to **Policy & Objects** → **Virtual IPs**.

        3. Click **Create New** and select **Virtual IP**.

        4. In the **VIP Type** section, select **IPv4**.

        5. In the **Name** field, enter a name for the virtual IP address.

        6. Optional: in the **Comments** field, enter a comment for the virtual IP address.

        7. In the **Interface** field, specify the firewall interface through which the virtual IP address will be accessible:

           * to make the IP address accessible only through one interface, select that interface. For example, **wan1**;
           * to make the IP address accessible through all interfaces, select **any**.

        8. In the **External IP Address/Range** field, specify the public IP address of the firewall you received in the ticket after [ordering the service](firewalls/order/order-hardware-firewall.mdx).

        9. In the **Mapped IP Address** field, specify the private address of the server behind the firewall to which you want to configure SSH access.

        10. Enable the **Port Forwarding** toggle.

        11. In the **Protocol** field, select **TCP**.

        12. In the **External Service Port** field, specify an available port on the firewall. For example, `8080`.

        13. In the **Map to Port** field, specify the port on which the SSH service is running on the server behind the firewall. By default, this is port 22.

        14. Click **OK**.
      </TabItem>

      <TabItem value="fortios-7">
        <TabItemLabel>
          FortiOS 7.x
        </TabItemLabel>

        1. [Connect to the firewall](/firewalls/fortigate/connect-to-firewall.mdx).

        2. Go to **Policy & Objects** → **Virtual IPs**.

        3. Select **Virtual IP** and click **Create New**.

        4. In the **Name** field, enter a name for the virtual IP address.

        5. Optional: in the **Comments** field, enter a comment for the virtual IP address.

        6. In the **Interface** field, specify the firewall interface through which the virtual IP address will be accessible:

           * to make the IP address accessible only through one interface, select that interface. For example, **wan1**;
           * to make the IP address accessible through all interfaces, select **any**.

        7. In the **External IP address/range** field, specify the public IP address of the firewall you received in the ticket after [ordering the service](firewalls/order/order-hardware-firewall.mdx).

        8. In the **Map to IPv4 address/range** field, specify the private address of the server behind the firewall to which you want to configure SSH access.

        9. Enable the **Port Forwarding** toggle.

        10. In the **Protocol** field, select **TCP**.

        11. In the **External service port** field, specify an available port on the firewall. For example, `8080`.

        12. In the **Map to IPv4 port** field, specify the port on which the SSH service is running on the server behind the firewall. By default, this is port 22.

        13. Click **OK**.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="cli">
    <TabItemLabel>
      CLI
    </TabItemLabel>

    1. [Connect to the firewall](/firewalls/fortigate/connect-to-firewall.mdx).
    2. Create a virtual IP address:

       ```bash
       config firewall vip
          edit "<virtual_ip_name>"
             set extip <public_ip_address>
             set extintf "<eth_name>"
             set portforward enable
             set protocol tcp
             set extport <public_port>
             set mappedip "<private_ip_address>"
             set mappedport <private_port>
          next
        end
       ```

       Specify:

       * `<virtual_ip_name>` — name of the virtual IP address;
       * `<public_ip_address>` — public IP address of the firewall you received in the ticket after [ordering the service](firewalls/order/order-hardware-firewall.mdx). For example, `203.0.113.2`;
       * `<eth_name>` — firewall interface name, so that the IP address is accessible only through this interface. You can view the list of interfaces using the `show system interface` command. To make the IP address accessible through all interfaces, specify `any`;
       * `<public_port>` — an available port on the firewall. For example, `8080`;
       * `<private_ip_address>` — private IP address of the server behind the firewall to which you want to configure SSH access. For example, `192.168.0.2`;
       * `<private_port>` — port on which the SSH service is running on the server behind the firewall. By default, this is port 22.
  </TabItem>
</Tabs>

## 2. Optional: create a virtual IP address group \{#create-virtual-ip-address-group}

Virtual IP address groups simplify security policy management: a policy is applied to the entire group rather than to each IP address individually. For example, you can allow SSH connections to all IP addresses in the group at once.

<Tabs queryString="create-virtual-ip-address-group">
  <TabItem value="graphic">
    <TabItemLabel>
      Graphical interface
    </TabItemLabel>

    <Tabs queryString="firmware-version">
      <TabItem value="fortios-6">
        <TabItemLabel>
          FortiOS 6.x
        </TabItemLabel>

        1. In the FortiGate control panel, go to **Policy & Objects** → **Virtual IPs**.

        2. Click **Create New** and select **Virtual IP Group**.

        3. In the **Type** field, select **IPv4**.

        4. In the **Name** field, enter a name for the virtual IP address group.

        5. Optional: in the **Comments** field, enter a comment for the virtual IP address group.

        6. In the **Interface** field, specify the firewall interface through which the virtual IP address group will be accessible:

           * if all IP addresses in the group are bound to one interface, select that interface. For example, **wan1**;
           * if IP addresses in the group are bound to different interfaces, select **any**.

        7. In the **Members** field, select the virtual IP addresses you want to include in the group — the virtual IP address you [created in step 1](#create-virtual-ip), and other IP addresses.

        8. Click **OK**.
      </TabItem>

      <TabItem value="fortios-7">
        <TabItemLabel>
          FortiOS 7.x
        </TabItemLabel>

        1. In the FortiGate control panel, go to **Policy & Objects** → **Virtual IPs**.

        2. Select **Virtual IP Group** and click **Create New**.

        3. In the **Name** field, enter a name for the virtual IP address group.

        4. Optional: in the **Comments** field, enter a comment for the virtual IP address group.

        5. In the **Interface** field, specify the firewall interface through which the virtual IP address group will be accessible:

           * if all IP addresses in the group are bound to one interface, select that interface. For example, **wan1**;
           * if IP addresses in the group are bound to different interfaces, select **any**.

        6. In the **Members** field, select the virtual IP addresses you want to include in the group — the virtual IP address you [created in step 1](#create-virtual-ip), and other IP addresses.

        7. Click **OK**.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="cli">
    <TabItemLabel>
      CLI
    </TabItemLabel>

    1. [Connect to the firewall](/firewalls/fortigate/connect-to-firewall.mdx).
    2. Create a virtual IP address group:

       ```bash
       config firewall vipgrp
          edit "<group_name>"
             set interface <eth_name>
             set member <virtual_ip_1> <virtual_ip_2>
          next
       end
       ```

       Specify:

       * `<group_name>` — name of the virtual IP address group;
       * `<eth_name>` — firewall interface name, if all IP addresses in the group are bound to this interface. You can view the list of interfaces using the `show system interface` command. If IP addresses in the group are bound to different interfaces, specify `any`;
       * `<virtual_ip_1>`, `<virtual_ip_2>` — names of the virtual IP addresses. You can view the list of virtual IP addresses using the `show firewall vip`.
  </TabItem>
</Tabs>

## 3. Create a security policy \{#create-security-policy}

A security policy defines what traffic a firewall will permit between its interfaces. For example, you can use a policy to allow connections to servers behind a firewall from a specific IP address and on a specific port. If no security policies are created, all traffic is dropped.

<Tabs queryString="create-security-policy">
  <TabItem value="graphic">
    <TabItemLabel>
      Graphical interface
    </TabItemLabel>

    <Tabs queryString="firmware-graphic">
      <TabItem value="fortios-6">
        <TabItemLabel>
          FortiOS 6.x
        </TabItemLabel>

        1. In the FortiGate control panel, go to **Policy & Objects** → **IPv4 Policy**.

        2. Click **Create New**.

        3. In the **Name** field, enter a name for the security policy.

        4. In the **Incoming Interface** field, select the public firewall interface.

        5. In the **Outgoing Interface** field, select the private firewall interface.

        6. In the **Source** field, select **all**.

        7. In the **Destination** field, select a destination address:

           * the virtual IP address you [created in step 1](#create-virtual-ip);
           * or the IP address group you [created in step 2](#create-virtual-ip-address-group).

        8. In the **Schedule** field, select **always**.

        9. In the **Service** field, select **all**.

        10. In the **Action** field, select **Accept**.

        11. Disable the **NAT** toggle. Servers behind the firewall will receive original connection IP addresses.

        12. Click **OK**.
      </TabItem>

      <TabItem value="fortios-7">
        <TabItemLabel>
          FortiOS 7.x
        </TabItemLabel>

        1. In the FortiGate control panel, go to **Policy & Objects** → **Firewall Policy**.

        2. Click **Create New**.

        3. In the **Name** field, enter a name for the security policy.

        4. In the **Incoming Interface** field, select the public firewall interface.

        5. In the **Outgoing Interface** field, select the private firewall interface.

        6. In the **Source** field, select **all**.

        7. In the **Destination** field, select a destination address:

           * the virtual IP address you [created in step 1](#create-virtual-ip);
           * or the IP address group you [created in step 2](#create-virtual-ip-address-group).

        8. In the **Schedule** field, select **always**.

        9. In the **Service** field, select **all**.

        10. In the **Action** field, select **Accept**.

        11. Disable the **NAT** toggle. Servers behind the firewall will receive original connection IP addresses.

        12. Click **OK**.
      </TabItem>
    </Tabs>
  </TabItem>

  <TabItem value="cli">
    <TabItemLabel>
      CLI
    </TabItemLabel>

    1. [Connect to the firewall](/firewalls/fortigate/connect-to-firewall.mdx).

    2. View the used security policy numbers by displaying information about the configured security policies:

       ```bash
       show firewall policy
       ```

       Information about the configured security policies will appear in the response. For example:

       ```bash
       config firewall policy
          edit 1
             set name "my_policy"
             set srcintf "lan"
             set dstintf "wan1"
             set action accept
             set srcaddr "all"
             set dstaddr "all"
             set schedule "always"
             set service "ALL"
             set nat enable
          next
       end
       ```

       Here `1` is the security policy number.

    3. Create a security policy:

       ```bash
       config firewall policy
          edit <policy_number>
             set name "<policy_name>"
             set srcintf "<incoming_interface>"
             set dstintf "<outgoing_interface>"
             set srcaddr "all"
             set dstaddr [ <virtual_ip> | <virtual_ip_group> ]
             set action accept
             set schedule "always"
             set service "ALL"
             set nat disable
          next
       end
       ```

       Specify:

       * `<policy_number>` — security policy number. Specify a free number to create a new policy;
       * `<policy_name>` — name of the security policy;
       * `<incoming_interface>` — name of the public firewall interface. You can view the list of interfaces using the `show system interface`;
       * `<outgoing_interface>` — name of the private firewall interface. You can view the list of interfaces using the `show system interface`;
       * destination address:

         * `<virtual_ip>` — name of the virtual IP address you [created in step 1](#create-virtual-ip) to apply the policy only to this IP address;
         * `<virtual_ip_group>` — name of the virtual IP address group you [created in step 2](#create-virtual-ip-address-group) to apply the policy to the group of IP addresses.
  </TabItem>
</Tabs>

<Formbricks />