How to Configure Internet Access on a FortiGate Firewall: Step-by-Step Guide

by

Configuring internet access is one of the first tasks you will perform when deploying a new FortiGate firewall.

A basic FortiGate internet configuration requires three main components:

  1. A correctly configured WAN interface
  2. A default route pointing to the ISP gateway
  3. A firewall policy allowing traffic from the internal network to the internet

In this guide, we will configure internet access using both the FortiGate web interface and CLI.

Note: Menu names and available options may vary slightly depending on your FortiOS version and FortiGate model.

Example Network Topology

We will use the following example throughout this guide:

Internet
   |
ISP Router
IP Address: 192.168.1.1
   |
FortiGate wan1
IP Address: 192.168.1.2/24
   |
FortiGate lan
IP Address: 192.168.10.1/24
   |
Internal Client
IP Address: 192.168.10.100
Gateway: 192.168.10.1

The FortiGate WAN interface connects to the ISP router, while the LAN interface provides connectivity to internal devices.

Step 1: Connect to the FortiGate Web Interface

Connect your computer to one of the FortiGate LAN or management interfaces.

Depending on the model and existing configuration, the default management address is commonly:

https://192.168.1.99

Log in using the administrator account.

On a factory-default device, the username is usually:

Username: admin
Password: Leave blank

FortiGate will normally require you to create a new administrator password during the first login.

If the default address does not respond, check the QuickStart Guide for your FortiGate model or configure your computer with an IP address in the same subnet.

Step 2: Configure the WAN Interface

The WAN interface connects the FortiGate firewall to your ISP router or modem.

Navigate to:

Network > Interfaces

Edit the interface connected to the ISP, such as wan1.

Configure the following settings:

Role: WAN
Addressing Mode: Manual
IP Address: 192.168.1.2/24
Administrative Access: PING

Select OK to save the configuration.

WAN Interface CLI Configuration

The same configuration can be applied through the CLI:

config system interface
    edit "wan1"
        set mode static
        set ip 192.168.1.2 255.255.255.0
        set role wan
        set allowaccess ping
    next
end

If your ISP provides an IP address automatically through DHCP, configure the interface as follows:

config system interface
    edit "wan1"
        set mode dhcp
        set role wan
        set allowaccess ping
    next
end

For PPPoE connections, the ISP username and password must also be configured on the WAN interface.

Security Recommendation

Avoid enabling HTTPS, HTTP or SSH administrative access directly on an internet-facing WAN interface unless it is strictly necessary.

For secure remote administration, consider using:

  • An IPsec or SSL VPN
  • Trusted hosts
  • Local-in policies
  • A dedicated management network

Step 3: Configure the LAN Interface

The LAN interface will act as the default gateway for devices on the internal network.

Navigate to:

Network > Interfaces

Edit the internal interface, such as lan, and configure:

Role: LAN
IP Address: 192.168.10.1/24
Administrative Access: PING, HTTPS and SSH

LAN Interface CLI Configuration

config system interface
    edit "lan"
        set ip 192.168.10.1 255.255.255.0
        set role lan
        set allowaccess ping https ssh
    next
end

Internal clients must use 192.168.10.1 as their default gateway.

Step 4: Configure the DHCP Server

A DHCP server allows FortiGate to assign IP addresses, gateways and DNS settings automatically to internal devices.

In the web interface, edit the LAN interface and enable the DHCP Server option.

Example DHCP configuration:

Gateway: Same as interface IP
Starting IP: 192.168.10.100
Ending IP: 192.168.10.200
Netmask: 255.255.255.0
DNS Server: Same as system DNS

DHCP Server CLI Configuration

config system dhcp server
    edit 1
        set interface "lan"
        set default-gateway 192.168.10.1
        set netmask 255.255.255.0
        set dns-service default

        config ip-range
            edit 1
                set start-ip 192.168.10.100
                set end-ip 192.168.10.200
            next
        end
    next
end

After applying the configuration, reconnect the client or renew its DHCP lease.

A Windows client can renew its address with:

ipconfig /release
ipconfig /renew

Step 5: Configure DNS Servers

FortiGate requires working DNS servers to resolve domain names and use services that depend on DNS.

Navigate to:

Network > DNS

You may use FortiGuard DNS, your ISP DNS servers or public DNS services.

Example CLI configuration:

config system dns
    set primary 1.1.1.1
    set secondary 8.8.8.8
end

You can test DNS resolution from FortiGate with:

execute ping google.com

If FortiGate can ping an external IP address but cannot resolve a domain name, the problem is likely related to DNS.

Step 6: Create the Default Route

A default route tells FortiGate where to send traffic when no more specific route exists.

Navigate to:

Network > Static Routes

Select Create New and configure:

Destination: 0.0.0.0/0
Gateway Address: 192.168.1.1
Interface: wan1
Administrative Distance: 10

The gateway address must be the next-hop device provided by your ISP or the local ISP router.

Default Route CLI Configuration

config router static
    edit 1
        set dst 0.0.0.0 0.0.0.0
        set gateway 192.168.1.1
        set device "wan1"
    next
end

If the WAN interface receives its configuration through DHCP, FortiGate may create the default route automatically.

Verify the routing table with:

get router info routing-table all

You should see a default route similar to:

S* 0.0.0.0/0 [10/0] via 192.168.1.1, wan1

Step 7: Create the LAN-to-WAN Firewall Policy

FortiGate denies traffic unless it matches an allowed firewall policy.

Navigate to:

Policy & Objects > Firewall Policy

Select Create New and configure:

Name: LAN-to-Internet
Incoming Interface: lan
Outgoing Interface: wan1
Source: all
Destination: all
Schedule: always
Service: ALL
Action: ACCEPT
NAT: Enabled
Log Allowed Traffic: All Sessions

Save the policy.

Firewall Policy CLI Configuration

config firewall policy
    edit 1
        set name "LAN-to-Internet"
        set srcintf "lan"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
        set logtraffic all
    next
end

Enabling NAT allows FortiGate to translate internal private IP addresses to the IP address assigned to the WAN interface.

For a basic lab environment, using the ALL service makes testing easier. In production environments, firewall rules should be restricted to the services that users actually require.

Step 8: Test Connectivity from FortiGate

Begin by testing the connection between FortiGate and the ISP gateway:

execute ping 192.168.1.1

Next, test internet connectivity using a public IP address:

execute ping 8.8.8.8

Finally, test DNS resolution:

execute ping google.com

These tests help identify where the problem is occurring.

  • If the ISP gateway does not respond, check the WAN interface and physical connection.
  • If the gateway responds but 8.8.8.8 does not, check the default route and upstream router.
  • If 8.8.8.8 responds but google.com does not, check the DNS configuration.

Step 9: Test Connectivity from an Internal Client

On the internal client, verify that it has received the correct configuration.

Example Windows command:

ipconfig /all

The client should have values similar to:

IPv4 Address: 192.168.10.100
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.10.1
DNS Server: 192.168.10.1 or a configured DNS server

Test the FortiGate LAN interface:

ping 192.168.10.1

Test an external IP address:

ping 8.8.8.8

Test DNS resolution:

nslookup fortiguru.net

You can also open a website in a browser to confirm that HTTP and HTTPS traffic works.

Basic Troubleshooting

If the internal client still cannot access the internet, check the following components.

Check Interface Status

get system interface physical

You can also inspect the interface configuration:

show system interface wan1
show system interface lan

Confirm that the interfaces are up and have the correct IP addresses.

Check the Routing Table

get router info routing-table all

Confirm that a default route exists and points to the correct gateway through wan1.

Check the Firewall Policy

Display the firewall policies:

show firewall policy

Confirm that:

  • The incoming interface is correct
  • The outgoing interface is correct
  • The policy action is set to accept
  • NAT is enabled
  • The policy is enabled
  • The policy is positioned above any conflicting deny rules

You can also check the policy hit counter in the web interface. If the counter remains at zero while the client generates traffic, the traffic is probably not matching the policy.

Check Active Sessions

Filter sessions by the client IP address:

diagnose sys session filter clear
diagnose sys session filter src 192.168.10.100
diagnose sys session list

Clear the filter when finished:

diagnose sys session filter clear

The session table can show whether FortiGate is creating and forwarding sessions for the client.

Check Which Policy Matches the Traffic

You can perform a policy lookup for a specific connection.

The following example checks a DNS request from the client to 8.8.8.8 over UDP port 53:

diagnose firewall iprope lookup 192.168.10.100 50000 8.8.8.8 53 17

The last value represents the protocol number:

6  = TCP
17 = UDP
1  = ICMP

Use Debug Flow

FortiGate debug flow is one of the most useful tools for identifying dropped traffic and policy-related issues.

Filter traffic by the client IP:

diagnose debug reset
diagnose debug flow filter clear
diagnose debug flow filter addr 192.168.10.100
diagnose debug flow show function-name enable
diagnose debug flow show iprope enable
diagnose debug enable
diagnose debug flow trace start 100

Generate traffic from the client and review the output.

Stop debugging when finished:

diagnose debug flow trace stop
diagnose debug disable
diagnose debug reset

Do not leave debugging enabled on a production firewall, as excessive debug output can affect management performance.

Common Configuration Mistakes

Missing Default Route

Without a default route, FortiGate does not know where to send internet-bound traffic.

Verify the route using:

get router info routing-table all

NAT Is Disabled

Private addresses such as 192.168.10.100 are not normally routable on the public internet.

For a standard outbound internet policy, NAT must usually be enabled.

Incorrect Firewall Policy Interfaces

The incoming interface must be the interface where the client traffic enters FortiGate.

The outgoing interface must be the interface used to reach the internet.

In this example:

Incoming Interface: lan
Outgoing Interface: wan1

Incorrect Client Gateway

Internal devices must use the FortiGate LAN IP address as their default gateway:

192.168.10.1

If the client uses a different gateway, its traffic may bypass FortiGate or fail to reach external networks.

DNS Configuration Problems

If clients can reach external IP addresses but websites do not open by name, verify the DNS settings.

Test with:

execute ping 8.8.8.8
execute ping google.com

Overlapping WAN and LAN Subnets

The WAN and LAN interfaces should not normally use the same IP subnet.

Incorrect example:

WAN: 192.168.1.2/24
LAN: 192.168.1.1/24

Correct example:

WAN: 192.168.1.2/24
LAN: 192.168.10.1/24

Using separate subnets prevents routing conflicts.

Recommended Security Improvements

The configuration in this guide provides basic internet connectivity. Before deploying the firewall in production, consider applying additional security controls.

Restrict Firewall Services

Instead of allowing all services, create a more restrictive policy that permits only the required traffic, such as:

DNS
HTTP
HTTPS
NTP

Enable Security Profiles

FortiGate security profiles can provide additional protection through:

  • Antivirus
  • Intrusion Prevention
  • Web Filtering
  • DNS Filtering
  • Application Control
  • SSL Inspection

The available security services may depend on your FortiGuard subscription.

Enable Logging

Enable traffic logging on important firewall policies and send logs to an appropriate destination, such as:

  • FortiAnalyzer
  • FortiGate local storage
  • FortiCloud
  • A syslog server

Protect Administrative Access

Use strong administrator passwords and avoid exposing the management interface directly to the internet.

Where possible:

  • Restrict administrator access with trusted hosts
  • Use multi-factor authentication
  • Create separate administrator accounts
  • Use VPN access for remote management
  • Disable unused administrative protocols

Complete CLI Configuration Example

The following example combines the main configuration sections used in this guide:

config system interface
    edit "wan1"
        set mode static
        set ip 192.168.1.2 255.255.255.0
        set role wan
        set allowaccess ping
    next

    edit "lan"
        set ip 192.168.10.1 255.255.255.0
        set role lan
        set allowaccess ping https ssh
    next
end

config system dns
    set primary 1.1.1.1
    set secondary 8.8.8.8
end

config system dhcp server
    edit 1
        set interface "lan"
        set default-gateway 192.168.10.1
        set netmask 255.255.255.0
        set dns-service default

        config ip-range
            edit 1
                set start-ip 192.168.10.100
                set end-ip 192.168.10.200
            next
        end
    next
end

config router static
    edit 1
        set dst 0.0.0.0 0.0.0.0
        set gateway 192.168.1.1
        set device "wan1"
    next
end

config firewall policy
    edit 1
        set name "LAN-to-Internet"
        set srcintf "lan"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
        set logtraffic all
    next
end

Interface names and object IDs may be different on your device. Review the existing configuration before copying commands into a production firewall.

Conclusion

Providing internet access through a FortiGate firewall requires a correctly configured WAN interface, LAN interface, default route and outbound firewall policy.

The basic traffic flow is:

Internal Client
      |
LAN Interface
      |
LAN-to-WAN Firewall Policy
      |
Source NAT
      |
Default Route
      |
WAN Interface
      |
Internet

When troubleshooting, test each stage separately:

  1. Verify interface status
  2. Test the ISP gateway
  3. Confirm the default route
  4. Verify the firewall policy and NAT
  5. Test external IP connectivity
  6. Test DNS resolution
  7. Review sessions and debug flow

Once the basic connection is working, you can improve the deployment by enabling security profiles, restricting allowed services, centralizing logs and securing administrative access.

In future FortiGuru guides, we will examine FortiGate firewall policies, NAT behavior, security profiles and troubleshooting tools in greater detail.

Leave a Comment