{"id":438,"date":"2026-08-12T11:24:42","date_gmt":"2026-08-12T05:54:42","guid":{"rendered":"https:\/\/networkfix.in\/uncategorized\/fortigate-virtual-ip-and-port-forwarding-configuration-with-a-real-lif\/"},"modified":"2026-09-14T04:35:21","modified_gmt":"2026-09-13T23:05:21","slug":"fortigate-virtual-ip-and-port-forwarding-configuration-with-a-real-lif","status":"publish","type":"post","link":"https:\/\/networkfix.in\/en\/tutorials\/fortinet\/fortigate-virtual-ip-and-port-forwarding-configuration-with-a-real-lif\/","title":{"rendered":"FortiGate Virtual IP and Port Forwarding Configuration with a Real-Life Example"},"content":{"rendered":"

Publishing internal applications to the Internet safely requires precise control over Destination Network Address Translation (DNAT) and firewall security rules. On FortiGate firewalls, DNAT and port forwarding are implemented using Virtual IPs (VIPs). A Virtual IP maps an external public IP address and port to an internal private IP address and port.<\/p>\n

Understanding FortiGate VIP port forwarding<\/strong> is essential for network and security administrators who need to host web applications, email servers, or public services behind a firewall without exposing internal networks to unnecessary risk. This step-by-step technical guide covers the concepts, configuration, packet processing flow, and troubleshooting methods for Virtual IPs on FortiOS.<\/p>\n

Real-Life Scenario<\/h2>\n

Acme Corporation hosts an internal documentation portal on a Linux web server located in its DMZ subnet. The server runs an HTTPS web service listening on standard port TCP 443 with private IP 10.0.10.50<\/code>.<\/p>\n

The company’s Internet Service Provider (ISP) assigned a public IPv4 block to the primary WAN interface (wan1<\/code>). Acme Corp needs to publish this web server to external remote employees using a public documentation address (203.0.113.10<\/code>) over standard HTTPS port 443.<\/p>\n

To achieve this securely, you must configure a FortiGate Virtual IP to translate external incoming requests on 203.0.113.10:443<\/code> to 10.0.10.50:443<\/code>, then create a matching firewall policy allowing ingress traffic from the WAN to the DMZ.<\/p>\n

Lab Topology<\/h2>\n

The network topology below illustrates the physical and logical placement of the FortiGate firewall between the Internet host and the internal DMZ web server.<\/p>\n

\n+-----------------------+              +-----------------------+              +-----------------------+\n|    External Client    |              |   FortiGate Firewall  |              |    DMZ Web Server     |\n|   (Internet User)     |              |     (FortiOS 7.x)     |              |   (HTTPS Portal)      |\n|                       |              |                       |              |                       |\n| IP: 198.51.100.25     |=============>| Interface: wan1       |=============>| Interface: dmz        |\n| Target: 203.0.113.10  |  Public WAN  | VIP: 203.0.113.10     |  Internal    | IP: 10.0.10.50        |\n| Port: TCP 443         |              | Mapped: 10.0.10.50    |  DMZ Subnet  | Port: TCP 443         |\n+-----------------------+              +-----------------------+              +-----------------------+\n<\/pre>\n
Example Addressing and Objects<\/h2>\n
The following example values are used throughout this guide. In production environments, replace these placeholder values with your actual public IPs, internal subnets, and interface names.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
Object \/ Parameter<\/th>\nExample Value<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
External WAN Interface<\/strong><\/td>\nwan1<\/code><\/td>\nPublic interface connected to the ISP router.<\/td>\n<\/tr>\n
Internal DMZ Interface<\/strong><\/td>\ndmz<\/code><\/td>\nPrivate interface connected to the DMZ switch segment.<\/td>\n<\/tr>\n
Public Destination IP (External)<\/strong><\/td>\n203.0.113.10<\/code><\/td>\nPublic documentation IP address bound to the Virtual IP object.<\/td>\n<\/tr>\n
Mapped Private IP (Internal)<\/strong><\/td>\n10.0.10.50<\/code><\/td>\nInternal IP address of the Linux HTTPS server.<\/td>\n<\/tr>\n
External Port \/ Services<\/strong><\/td>\nTCP 443 (HTTPS)<\/td>\nIncoming service port requested by external clients.<\/td>\n<\/tr>\n
Mapped Port<\/strong><\/td>\nTCP 443 (HTTPS)<\/td>\nDestination port where the application server listens.<\/td>\n<\/tr>\n
VIP Object Name<\/strong><\/td>\nVIP_DMZ_HTTPS_Server<\/code><\/td>\nName assigned to the FortiGate Virtual IP object.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Prerequisites<\/h2>\n