0

The following diagram show the topology of our organization's network. We use two firewalls that one of them is a Fortigate 1500D and the other is OPNsense (firewall 2). Our network is connected to the Internet via two ISP (namely, 20.1.1.x/24 and 30.1.1.x/24). ISP-A is used for organization's servers (inbound: server updates and outbound: connecting people to the web and the other services) and ISP-B is used for connection users (LAN) to the Internet.

The network topology

Recently we have decided to connect some of our servers to the Internet via ISP-B (inbound and outbound). To do that, we use port#32 interface of the Fortigate firewall.

We first define a virtual IP as:

edit "HTTP web server"
    set uuid bla-bla-blla
    set extip 20.1.1.50
    set mappedip "192.168.1.50"
    set extintf "any"
next

Then, we add a firewall policy to route the inbound traffic that received via p#32 interface to the DMZ zone via p#35 interface:

config firewall policy
    edit 1
        set name "ISP B to HTTP server"
        set uuid bla-bla-bla
        set srcintf "port32"
        set dstintf "port35"
        set action accept
        set srcaddr "all"
        set dstaddr "HTTP web server"
        set schedule "always"
        set service "HTTP"
        set logtraffic all
    next
end

But, when we try to connect to the web server from outside, it take some time and finally give up with ERR_CONECTION_TIMED_OUT.

I tried to debug it:

diagnose sniffer packet any 'host 20.1.1.50' 4 0 l

and the following is the results:

2026-02-19 06:48:42.552479 ISP-A out 20.1.1.50.57814 -> some-where-1.443: syn 2921345574
2026-02-19 06:48:42.552483 port15 out 20.1.1.50.57814 -> some-where-1.443: syn 2921345574
2026-02-19 06:48:44.553258 ISP-A out 20.1.1.50.57814 -> some-where-1.443: syn 2921345574
2026-02-19 06:48:44.553264 port15 out 20.1.1.50.57814 -> some-where-1.443: syn 2921345574
2026-02-19 06:48:48.554800 ISP-A out 20.1.1.50.57814 -> some-where-1.443: syn 2921345574
2026-02-19 06:48:48.554803 port15 out 20.1.1.50.57814 -> some-where-1.443: syn 2921345574
2026-02-19 06:49:38.756170 ISP-A out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:38.756173 port15 out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:39.007718 ISP-A out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
2026-02-19 06:49:39.007721 port15 out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
2026-02-19 06:49:39.758784 ISP-A out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:39.758788 port15 out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:40.012923 ISP-A out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
2026-02-19 06:49:40.012926 port15 out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
2026-02-19 06:49:41.768701 ISP-A out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:41.768705 port15 out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:42.021845 ISP-A out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
2026-02-19 06:49:42.021848 port15 out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
2026-02-19 06:49:45.773362 ISP-A out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:45.773365 port15 out 20.1.1.50.57817 -> some-where-2.443: syn 3188629095
2026-02-19 06:49:46.024616 ISP-A out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840
2026-02-19 06:49:46.024619 port15 out 20.1.1.50.57818 -> some-where-2.443: syn 2344899840

according to the results, it seems that the packets go to the wrong path. But something is not clear for me: Why it is not show when and from which port the packets enter the Fortigate? Are they mapped to the correct internal IP (192.168.1.50)?

My main question: Why do the packets go to the wrong path (from ISP-B to ISP-A)? and how can I correct it?

Any help would be appreciated.

2
  • Please don't use public IP addresses for obfuscation in your question - private addresses are just fine, or 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 as 'public' ones. Have you run a packet trace on the Fortigate's egress port? I suspect that NAT is missing from the rule. Commented Feb 19 at 12:41
  • We really need to see the full configurations. Speculation and guessing are off-topic here. Commented Feb 19 at 14:54

0

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.