Hairpin NAT in Fortigate Firewall (Servers and clients behind different firewall interface)

Hairpin NAT in Fortigate Firewall (Servers and clients behind different firewall interface)

Network Diagram:

 

 

Firewall Configuration:

Interface configuration:

config system interface
    edit "port1"
        set vdom "root"
        set ip 10.10.10.108 255.255.255.0
        set allowaccess ping https ssh http fgfm
        set type physical
        set snmp-index 1
    next
    edit "port2"
        set vdom "root"
        set ip 14.140.40.108 255.255.255.0
        set allowaccess ping
        set type physical
        set snmp-index 2
    next
    edit "port3"
        set vdom "root"
        set ip 192.168.137.108 255.255.255.0
        set allowaccess ping ssh http telnet
        set type physical
        set snmp-index 3
    next

VIP Object:

config firewall vip
    edit "HAIR_PIN_NAT_VIP"
        set uuid 36cbcfc0-cc2b-51ec-62de-49f33b9e6be9
        set extip 14.140.40.108
        set mappedip "192.168.137.132"
        set extintf "any"
        set portforward enable
        set extport 12345
        set mappedport 22
    next
end
 

Policy:

config firewall policy
    edit 1
        set name "DNAT_OUT_IN"
        set uuid f38e422e-cc2a-51ec-e4fc-ee0bab63cb75
        set srcintf "port2"
        set dstintf "port3"
        set action accept
        set srcaddr "all"
        set dstaddr "HAIR_PIN_NAT_VIP"
        set schedule "always"
        set service "ALL"
        set nat enable
    next
    edit 2
        set name "ALLOW_INTERNAL_CLIENT"
        set uuid 0051b04c-cc2e-51ec-3304-494d93b28618
        set srcintf "port1"
        set dstintf "port2"
        set action accept
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set nat enable
    next
end