Virtual IPs with port forwarding

If you need to hide the internal server port number or need to map several internal servers to the same public IP address, enable port-forwarding for Virtual IP.

This topic shows how to use virtual IPs to configure port forwarding on a FortiGate unit. This example has one public external IP address. We map TCP ports 8080, 8081, and 8082 to different internal WebServers' TCP port 80. This allows remote connections to communicate with a server behind the firewall.

Sample configuration

To create a virtual IP with port forwarding in the GUI:
  1. In Policy & Objects > Virtual IPs.
  2. Click Create New and select Virtual IP.
  3. For VIP Type, select IPv4.
  4. Enter a unique name for the virtual IP and fill in the other fields.
  5. Configure the fields in the Network section. For example:
    • Set Interface to any.
    • Set External IP Address/Range to
    • Set Mapped IP Address/Range to
  6. Leave Optional Filters disabled.
  7. Enable Port Forwarding.
  8. Configure the fields in the Port Forwarding section. For example:
    • Set Protocol to TCP.
    • Set External Service Port to 8080.
    • Set Map to IPv4 port to 80.

  9. Click OK.
  10. Follow the above steps to create two additional virtual IPs.
    1. For one virtual IP:
      • Use a different Mapped IP Address/Range, for example,
      • Set External Service Port to