Virtual Server Reverse Proxy

What will be done

• Using a FortiGate to act as a Reverse Proxy, forwarding domain.tld to ip:port

Prerequesits

• Static IP
• Port 443 (TCP) for HTTPS open

In this Example, Forgejo will be used as Application

1. Creating a Virtual Server

1. Go to Policy & Objects - Virtual Servers and Click Create New
2. Set a Name

1.2 Network Configuration

1. Set Type to HTTPS
2. Set Interface to your WAN Interface
3. Set Virtual server IP to your Public IP (or TN IP if behind a NAT Router)
4. Set Virtual server port to 443
5. Set Load balancing method to HTTP Host
6. Set Persistence to HTTP Cookie
7. Enable Preserve client IP

You can add Health Checks here for your internal Servers if wanted

1.3 SSL Offloading

As the FortiGate will be acting as Reverse Proxy in this Situation, SSL Encryption needs to be done at the Firewall. Select/Upload your SSL Certificate here and Set Mode to Full

1.4 Real Servers

For each public Domain, create a Real Server here

Example: git.domain.tld

1. Click Create New
2. Set IPv4 Address to your internal Server IP Address
3. Set Port to your internal Server Port
4. Set Max connections to 0 for unlimited Connections or set a fixed limit
5. Set HTTP host to your public Domain
6. Set Mode to Active

 

2. Creating Firewall Policy

We need a Proxy-based Policy that allows WAN Access to the created Virtual Server