Configure port forwarding

Last update: July 28 2026

For your information

This manual provides instructions for configuring port forwarding on a firewall to access servers via SSH.

To access a server behind a firewall, you can configure port forwarding (port forwarding). This allows you to connect to a server using the public IP address of the firewall without needing to know the private address of the server. Users will connect to the server only through the ports you specify in the settings.

The settings in this manual are relevant for FortiOS 6.x and 7.x versions. If you are using a different version of FortiOS, you can find the documentation for it in the FortiGate control panel in the upper right corner or on the official FortiGate website.

To configure port forwarding:

1. Create a virtual IP address.
2. Optional: create a virtual IP address group.
3. Create a security policy.

1. Create a virtual IP address

A virtual IP address maps the public address of the firewall to a private address of a server behind the firewall. When a user tries to connect using the public address, FortiGate redirects the request to the required server.

Graphical interface

FortiOS 6.x

1. Connect to the firewall.

2. Go to Policy & Objects → Virtual IPs.

3. Click Create New and select Virtual IP.

4. In the VIP Type section, select IPv4.

5. In the Name field, enter a name for the virtual IP address.

6. Optional: in the Comments field, enter a comment for the virtual IP address.

7. In the Interface field, specify the firewall interface through which the virtual IP address will be accessible:

   • to make the IP address accessible only through one interface, select that interface. For example, wan1;
   • to make the IP address accessible through all interfaces, select any.

8. In the External IP Address/Range field, specify the public IP address of the firewall you received in the ticket after ordering the service.

9. In the Mapped IP Address field, specify the private address of the server behind the firewall to which you want to configure SSH access.

10. Enable the Port Forwarding toggle.

11. In the Protocol field, select TCP.

12. In the External Service Port field, specify an available port on the firewall. For example, 8080.

13. In the Map to Port field, specify the port on which the SSH service is running on the server behind the firewall. By default, this is port 22.

14. Click OK.

FortiOS 7.x

1. Connect to the firewall.

2. Go to Policy & Objects → Virtual IPs.

3. Select Virtual IP and click Create New.

4. In the Name field, enter a name for the virtual IP address.

5. Optional: in the Comments field, enter a comment for the virtual IP address.

6. In the Interface field, specify the firewall interface through which the virtual IP address will be accessible:

   • to make the IP address accessible only through one interface, select that interface. For example, wan1;
   • to make the IP address accessible through all interfaces, select any.

7. In the External IP address/range field, specify the public IP address of the firewall you received in the ticket after ordering the service.

8. In the Map to IPv4 address/range field, specify the private address of the server behind the firewall to which you want to configure SSH access.

9. Enable the Port Forwarding toggle.

10. In the Protocol field, select TCP.

11. In the External service port field, specify an available port on the firewall. For example, 8080.

12. In the Map to IPv4 port field, specify the port on which the SSH service is running on the server behind the firewall. By default, this is port 22.

13. Click OK.

CLI

1. Connect to the firewall.

2. Create a virtual IP address:

   config firewall vip
      edit "<virtual_ip_name>"
         set extip <public_ip_address>
         set extintf "<eth_name>"
         set portforward enable
         set protocol tcp
         set extport <public_port>
         set mappedip "<private_ip_address>"
         set mappedport <private_port>
      next
    end

   Specify:

   • <virtual_ip_name> — name of the virtual IP address;
   • <public_ip_address> — public IP address of the firewall you received in the ticket after ordering the service. For example, 203.0.113.2;
   • <eth_name> — firewall interface name, so that the IP address is accessible only through this interface. You can view the list of interfaces using the show system interface command. To make the IP address accessible through all interfaces, specify any;
   • <public_port> — an available port on the firewall. For example, 8080;
   • <private_ip_address> — private IP address of the server behind the firewall to which you want to configure SSH access. For example, 192.168.0.2;
   • <private_port> — port on which the SSH service is running on the server behind the firewall. By default, this is port 22.

2. Optional: create a virtual IP address group

Virtual IP address groups simplify security policy management: a policy is applied to the entire group rather than to each IP address individually. For example, you can allow SSH connections to all IP addresses in a group at once.

Graphical interface

FortiOS 6.x

1. In the FortiGate control panel, go to Policy & Objects → Virtual IPs.

2. Click Create New and select Virtual IP Group.

3. In the Type field, select IPv4.

4. In the Name field, enter a name for the virtual IP address group.

5. Optional: in the Comments field, enter a comment for the virtual IP address group.

6. In the Interface field, specify the firewall interface through which the virtual IP address group will be accessible:

   • if all IP addresses in the group are bound to one interface, select that interface. For example, wan1;
   • if IP addresses in the group are bound to different interfaces, select any.

7. In the Members field, select the virtual IP addresses you want to include in the group — the virtual IP address you created in step 1, and other IP addresses.

8. Click OK.

FortiOS 7.x

1. In the FortiGate control panel, go to Policy & Objects → Virtual IPs.

2. Select Virtual IP Group and click Create New.

3. In the Name field, enter a name for the virtual IP address group.

4. Optional: in the Comments field, enter a comment for the virtual IP address group.

5. In the Interface field, specify the firewall interface through which the virtual IP address group will be accessible:

   • if all IP addresses in the group are bound to one interface, select that interface. For example, wan1;
   • if IP addresses in the group are bound to different interfaces, select any.

6. In the Members field, select the virtual IP addresses you want to include in the group — the virtual IP address you created in step 1, and other IP addresses.

7. Click OK.

CLI

1. Connect to the firewall.

2. Create a virtual IP address group:

   config firewall vipgrp
      edit "<group_name>"
         set interface <eth_name>
         set member <virtual_ip_1> <virtual_ip_2>
      next
   end

   Specify:

   • <group_name> — name of the virtual IP address group;
   • <eth_name> — firewall interface name, if all IP addresses in the group are bound to this interface. You can view the list of interfaces using the show system interface command. If IP addresses in the group are bound to different interfaces, specify any;
   • <virtual_ip_1>, <virtual_ip_2> — names of the virtual IP addresses. You can view the list of virtual IP addresses using the show firewall vip.

3. Create a security policy

A security policy determines which traffic a firewall will allow between its interfaces. For example, using a policy, you can allow connections to servers behind the firewall from a specific IP address and on a specific port. If no security policies are created, all traffic is dropped.

Graphical interface

FortiOS 6.x

1. In the FortiGate control panel, go to Policy & Objects → IPv4 Policy.

2. Click Create New.

3. In the Name field, enter a name for the security policy.

4. In the Incoming Interface field, select the public firewall interface.

5. In the Outgoing Interface field, select the private firewall interface.

6. In the Source field, select all.

7. In the Destination field, select a destination address:

   • the virtual IP address you created in step 1;
   • or the IP address group you created in step 2.

8. In the Schedule field, select always.

9. In the Service field, select all.

10. In the Action field, select Accept.

11. Disable the NAT toggle. Servers behind the firewall will receive original connection IP addresses.

12. Click OK.

FortiOS 7.x

1. In the FortiGate control panel, go to Policy & Objects → Firewall Policy.

2. Click Create New.

3. In the Name field, enter a name for the security policy.

4. In the Incoming Interface field, select the public firewall interface.

5. In the Outgoing Interface field, select the private firewall interface.

6. In the Source field, select all.

7. In the Destination field, select a destination address:

   • the virtual IP address you created in step 1;
   • or the IP address group you created in step 2.

8. In the Schedule field, select always.

9. In the Service field, select all.

10. In the Action field, select Accept.

11. Disable the NAT toggle. Servers behind the firewall will receive original connection IP addresses.

12. Click OK.

CLI

1. Connect to the firewall.

2. View the used security policy numbers by displaying information about the configured security policies:

   show firewall policy

   Information about the configured security policies will appear in the response. For example:

   config firewall policy
      edit 1
         set name "my_policy"
         set srcintf "lan"
         set dstintf "wan1"
         set action accept
         set srcaddr "all"
         set dstaddr "all"
         set schedule "always"
         set service "ALL"
         set nat enable
      next
   end

   Here 1 is the security policy number.

3. Create a security policy:

   config firewall policy
      edit <policy_number>
         set name "<policy_name>"
         set srcintf "<incoming_interface>"
         set dstintf "<outgoing_interface>"
         set srcaddr "all"
         set dstaddr [ <virtual_ip> | <virtual_ip_group> ]
         set action accept
         set schedule "always"
         set service "ALL"
         set nat disable
      next
   end

   Specify:

   • <policy_number> — security policy number. Specify a free number to create a new policy;

   • <policy_name> — name of the security policy;

   • <incoming_interface> — name of the public firewall interface. You can view the list of interfaces using the show system interface;

   • <outgoing_interface> — name of the private firewall interface. You can view the list of interfaces using the show system interface;

   • destination address:

     • <virtual_ip> — name of the virtual IP address you created in step 1 to apply the policy only to this IP address;
     • <virtual_ip_group> — name of the virtual IP address group you created in step 2 to apply the policy to the group of IP addresses.