Helpful ReplyHot!Policy to allow SSH from a specific External IP?

Author
Post
Essentials Only Full Version
Allferry
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2021/01/11 03:27:50
  • Status: offline
2021/01/11 03:42:57 (permalink)
0

Policy to allow SSH from a specific External IP?

Hi lovely guys,
 
Can you point me to how can i create a policy to allow an external IP to SSH to a specific internal server? I have tried the below but server still can't be reached.
 
I've tried to add the external in Policy & Object>Addresses:
Name: External_SSH_Access
Type: Subnet
IP: xxx.xxx.xxx.xx
Interface: Any
 
And added a policy in Policy & Object>IPv4 Policy
Name: SSH_Access
Incoming: Wan1 (My wan port)
Outgoing: Prod Network (network where Server is)
Source: External_SSH_Access
Destination: Server_to_SSH (via VIP that points to WAN IP to LAN IP with port 22)
Schedule: Always
Server: SSH
Action: Accept
NAT:Off
Enable this policy: On
 
Done all these, but i the person in this External IP can't reach the server.
 
Any ideas on what am i missing, please. You help is much appreciated.
#1
List Solutions Only

6 Replies Related Threads
    Herbert_k3
    New Member
    • Total Posts : 1
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/15 08:02:50
    • Status: offline
    Re: Policy to allow SSH from a specific External IP? 2021/01/11 06:17:05 (permalink)
    0
    Hello,
    On the VIP object you can specify a permitted source address by set src-filter command, example:
     
    FortiGate # sh firewall vip FAC_SSH
    config firewall vip
    edit "FAC_SSH"
    set uuid 4fb2d328-5416-51eb-63ce-2697c2a45f2c
    set src-filter "192.168.15.49"
    set extip 192.168.103.10
    set mappedip "10.10.10.254"
    set extintf "any"
    set portforward enable
    set extport 2222
    set mappedport 22
    next
    end
    #2
    Markus
    Expert Member
    • Total Posts : 286
    • Scores: 59
    • Reward points: 0
    • Joined: 2015/03/19 07:30:23
    • Location: Switzerland
    • Status: offline
    Re: Policy to allow SSH from a specific External IP? 2021/01/11 06:18:23 (permalink)
    0
    Hello and welcome to the forums
     
     
    Try match-vip enable (on the policy in cli)
     
    Best
    #3
    pyy
    Bronze Member
    • Total Posts : 32
    • Scores: 2
    • Reward points: 0
    • Joined: 2015/10/21 10:57:48
    • Status: offline
    Re: Policy to allow SSH from a specific External IP? 2021/01/11 06:52:23 (permalink) ☄ Helpfulby JerryPWhite 2021/01/11 08:45:43
    0
    Hello Allferry,
     
    If you want to use the same public for the VIP and the firewall external check if your fortigate is listening on port22.
    If it is then you have 2 options:
    1. Change the FG ssh ports to something else
    2. Perform PAT in the VIP saying that if you request port 2222 translated to your server ip port 22. The server will be accessible from the remote ip as your-publicip:2222
     
     
    #4
    JerryPWhite
    New Member
    • Total Posts : 15
    • Scores: 0
    • Reward points: 0
    • Joined: 2014/12/08 16:16:44
    • Status: offline
    Re: Policy to allow SSH from a specific External IP? 2021/01/11 08:47:26 (permalink)
    0
    pyy
    Hello Allferry,
     
    If you want to use the same public for the VIP and the firewall external check if your fortigate is listening on port22.
    If it is then you have 2 options:
    1. Change the FG ssh ports to something else
    2. Perform PAT in the VIP saying that if you request port 2222 translated to your server ip port 22. The server will be accessible from the remote ip as your-publicip:2222
     
     


    Yep. Easiest way is to change the SSH port on outside interface to something else.

    Jerry Paul White
    Network Engineer/Tech Supervisor
    " 01001000 01100001 01110110 01100101 00100000 01100001 00100000 01000111 01101111 01101111 01100100 00100000 01000100 01100001 01111001"
    #5
    Allferry
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2021/01/11 03:27:50
    • Status: offline
    Re: Policy to allow SSH from a specific External IP? 2021/01/15 00:33:09 (permalink)
    0
    Thanks Guys,
     
    I'll try this last approach.
     
    Many thanks
    Allferry
    #6
    NoPurposeInLife
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2021/01/15 02:44:12
    • Status: offline
    Re: Policy to allow SSH from a specific External IP? 2021/01/15 02:50:06 (permalink)
    0
     
    1. Put the rule at the top of the IPv4 Policy
    2. Change the source to ALL
     
    If both this two works, you can ensure that your rule is working as expected. However, if it doesnt work when both steps is done, i would suggest checking the port forwarding configuration under "Policy & Objects" > "Virtual IPs". Make sure that an IPv4 Virtual IP and IPv4 Virtual IP Group is created for the connection
    #7
    Jump to:
    © 2021 APG vNext Commercial Version 5.5