Configure port forwarding

Last update: October 05 2026Open in Markdown

For your information

This manual provides instructions for configuring port forwarding on a firewall to access servers via SSH.

Для доступа к серверу за межсетевым экраном можно настроить переадресацию портов (port forwarding). Это позволяет подключаться к серверу по публичному IP-адресу межсетевого экрана без необходимости знать приватный адрес сервера. Пользователи будут подключаться к серверу только по тем портам, которые вы укажете в настройках.

The settings in the instructions are relevant for FortiOS versions 6.x and 7.x. If you have a different FortiOS version, you can find documentation for it in the top right corner of the FortiGate control panel or on the official FortiGate website.

To configure port forwarding:

1. Create a virtual IP address.
2. Optional: create a virtual IP address group.
3. Create a security policy.

1. Create a virtual IP address

A virtual IP address maps the public address of the firewall to a private address of a server behind the firewall. When a user tries to connect using the public address, FortiGate redirects the request to the required server.

Graphical interface

FortiOS 6.x

1. Connect to the firewall.

2. Go to Policy & Objects → Virtual IPs.

3. Click Create New and select Virtual IP.

4. In the VIP Type section, select IPv4.

5. In the Name field, enter the name of the virtual IP address.

6. Optional: in the Comments field, enter a comment for the virtual IP address.

7. In the Interface field, specify which firewall interface the virtual IP address will be accessible through:

   • to make the IP address accessible only through one interface, select this interface. For example, wan1;
   • to make the IP address accessible through all interfaces, select any.

8. In the External IP Address/Range field, specify the public IP address of the firewall that you received in the ticket after ordering the service.

9. In the Mapped IP Address field, specify the private address of the server behind the firewall to which SSH access needs to be configured.

10. Turn on the Port Forwarding toggle switch.

11. In the Protocol field, select TCP.

12. In the External Service Port field, specify an available port on the firewall. For example, 8080.

13. In the Map to Port field, specify the port on which the SSH service is running on the server behind the firewall. By default, it is port 22.

14. Click OK.

FortiOS 7.x

1. Connect to the firewall.

2. Go to Policy & Objects → Virtual IPs.

3. Select Virtual IP and click Create New.

4. In the Name field, enter the name of the virtual IP address.

5. Optional: in the Comments field, enter a comment for the virtual IP address.

6. In the Interface field, specify which firewall interface the virtual IP address will be accessible through:

   • to make the IP address accessible only through one interface, select this interface. For example, wan1;
   • to make the IP address accessible through all interfaces, select any.

7. In the External IP address/range field, specify the public IP address of the firewall that you received in the ticket after ordering the service.

8. In the Map to IPv4 address/range field, specify the private address of the server behind the firewall to which SSH access needs to be configured.

9. Turn on the Port Forwarding toggle switch.

10. In the Protocol field, select TCP.

11. In the External service port field, specify an available port on the firewall. For example, 8080.

12. In the Map to IPv4 port field, specify the port on which the SSH service is running on the server behind the firewall. By default, it is port 22.

13. Click OK.

CLI

1. Connect to the firewall.

2. Create a virtual IP address:

   config firewall vip
      edit "<virtual_ip_name>"
         set extip <public_ip_address>
         set extintf "<eth_name>"
         set portforward enable
         set protocol tcp
         set extport <public_port>
         set mappedip "<private_ip_address>"
         set mappedport <private_port>
      next
    end

   Specify:

   • <virtual_ip_name> — name of the virtual IP address;
   • <public_ip_address> — public IP address of the firewall that you received in the ticket after ordering the service. For example, 203.0.113.2;
   • <eth_name> — name of the firewall interface to make the IP address accessible only through this interface. You can view the list of interfaces using the show system interface command. To make the IP address accessible through all interfaces, specify any;
   • <public_port> — available port on the firewall. For example, 8080;
   • <private_ip_address> — private IP address of the server behind the firewall to which SSH access needs to be configured. For example, 192.168.0.2;
   • <private_port> — port on which the SSH service is running on the server behind the firewall. By default, it is port 22.

2. Optional: create a virtual IP address group

Virtual IP address groups simplify security policy management: a policy is applied to the entire group rather than to each IP address individually. For example, you can allow SSH connections to all IP addresses in the group at once.

Graphical interface

FortiOS 6.x

1. In the FortiGate control panel, go to Policy & Objects → Virtual IPs.

2. Click Create New and select Virtual IP Group.

3. In the Type field, select IPv4.

4. In the Name field, enter the name of the virtual IP address group.

5. Optional: in the Comments field, enter a comment for the virtual IP address group.

6. In the Interface field, specify which firewall interface the virtual IP address group will be accessible through:

   • if all IP addresses in the group are bound to a single interface, select this interface. For example, wan1;
   • if the IP addresses in the group are bound to different interfaces, select any.

7. In the Members field, select the virtual IP addresses to include in the group: the virtual IP address that you created in step 1 and other IP addresses.

8. Click OK.

FortiOS 7.x

1. In the FortiGate control panel, go to Policy & Objects → Virtual IPs.

2. Select Virtual IP Group and click Create New.

3. In the Name field, enter the name of the virtual IP address group.

4. Optional: in the Comments field, enter a comment for the virtual IP address group.

5. In the Interface field, specify which firewall interface the virtual IP address group will be accessible through:

   • if all IP addresses in the group are bound to a single interface, select this interface. For example, wan1;
   • if the IP addresses in the group are bound to different interfaces, select any.

6. In the Members field, select the virtual IP addresses to include in the group: the virtual IP address that you created in step 1 and other IP addresses.

7. Click OK.

CLI

1. Connect to the firewall.

2. Create a virtual IP address group:

   config firewall vipgrp
      edit "<group_name>"
         set interface <eth_name>
         set member <virtual_ip_1> <virtual_ip_2>
      next
   end

   Specify:

   • <group_name> — name of the virtual IP address group;
   • <eth_name> — name of the firewall interface if all IP addresses in the group are bound to this interface. You can view the list of interfaces using the show system interface command. If the IP addresses in the group are bound to different interfaces, specify any;
   • <virtual_ip_1>, <virtual_ip_2> — names of the virtual IP addresses. You can view the list of virtual IP addresses using the show firewall vip command.

3. Create a security policy

A security policy defines what traffic a firewall will permit between its interfaces. For example, you can use a policy to allow connections to servers behind a firewall from a specific IP address and on a specific port. If no security policies are created, all traffic is dropped.

Graphical interface

FortiOS 6.x

1. In the FortiGate control panel, go to Policy & Objects → IPv4 Policy.

2. Click Create New.

3. In the Name field, enter the name of the security policy.

4. In the Incoming Interface field, select the public interface of the firewall.

5. In the Outgoing Interface field, select the private interface of the firewall.

6. In the Source field, select all.

7. In the Destination field, select the destination address:

   • the virtual IP address that you created in step 1;
   • or the IP address group that you created in step 2.

8. In the Schedule field, select always.

9. In the Service field, select all.

10. In the Action field, select Accept.

11. Turn off the NAT toggle switch. The servers behind the firewall will receive original source IP addresses of connections.

12. Click OK.

FortiOS 7.x

1. In the FortiGate control panel, go to Policy & Objects → Firewall Policy.

2. Click Create New.

3. In the Name field, enter the name of the security policy.

4. In the Incoming Interface field, select the public interface of the firewall.

5. In the Outgoing Interface field, select the private interface of the firewall.

6. In the Source field, select all.

7. In the Destination field, select the destination address:

   • the virtual IP address that you created in step 1;
   • or the IP address group that you created in step 2.

8. In the Schedule field, select always.

9. In the Service field, select all.

10. In the Action field, select Accept.

11. Turn off the NAT toggle switch. The servers behind the firewall will receive original source IP addresses of connections.

12. Click OK.

CLI

1. Connect to the firewall.

2. View the used security policy numbers by displaying information about the configured security policies:

   show firewall policy

   Information about the configured security policies will appear in the response. For example:

   config firewall policy
      edit 1
         set name "my_policy"
         set srcintf "lan"
         set dstintf "wan1"
         set action accept
         set srcaddr "all"
         set dstaddr "all"
         set schedule "always"
         set service "ALL"
         set nat enable
      next
   end

   Here, 1 is the security policy number.

3. Create a security policy:

   config firewall policy
      edit <policy_number>
         set name "<policy_name>"
         set srcintf "<incoming_interface>"
         set dstintf "<outgoing_interface>"
         set srcaddr "all"
         set dstaddr [ <virtual_ip> | <virtual_ip_group> ]
         set action accept
         set schedule "always"
         set service "ALL"
         set nat disable
      next
   end

   Specify:

   • <policy_number> — security policy number. Specify an unused number to create a new policy;

   • <policy_name> — name of the security policy;

   • <incoming_interface> — name of the public firewall interface. You can view the list of interfaces using the show system interface command;

   • <outgoing_interface> — name of the private firewall interface. You can view the list of interfaces using the show system interface command;

   • destination address:

     • <virtual_ip> — name of the virtual IP address that you created in step 1 to apply the policy only to this IP address;
     • <virtual_ip_group> — name of the virtual IP address group that you created in step 2 to apply the policy to the group of IP addresses.