I set up on our company's firewall (fortigate100d) a port forwarding to one of our Internal services.
As we don't have a static public IP I used as an external IP so the remote users can access the internal service through a DDNS service which will handle IP changes.

The question is: does making as an external IP, exposes our internal services or even the firewall to potential threats.


In a default scenario (one internal, one external network) this will not harm you! You are using PAT so the rule is still bound to a specific port and does not put your network in danger.

If you have more then one external network attached you might have to think about it again. In that case you whould have to decide if the forwarding rule should be applied to both or just one external network.

  • what is exactly the threat in case of more then one external network ? – elsadek Mar 26 '16 at 18:12

With Fortigate devices, you can map your Virtual IPs to an interface.

I strongly suggest you to map your port forwarding object (Virtual IP) to your WAN interface, instead of any which is the default value.

I also suggest you to explicitly specify Incoming Interface and Outgoing Interface in your firewall policies.

If you properly map your object to the good interface and specify the two interfaces in your policy, you should not have any issue.

  • I'm not sure this answers the question. Or if it does, the connection is not clear. – schroeder Dec 28 '15 at 19:21
  • I'm just trying to explain how to configure this to minimize the threat in that case. It does not answer the question in a general case, but in that particular situation – Jyo de Lys Dec 30 '15 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.