No Internet Access Behind FortiGate Firewall

Problem Description

One of the most common FortiGate issues is when users behind the firewall have no internet access, even though the FortiGate itself can reach the internet. This usually happens after initial setup, policy changes, or NAT configuration updates.

 Common Symptoms

• FortiGate can ping external IPs
• Internal users have no internet
• DNS fails for LAN users
• Firewall policies appear correct but traffic is blocked

Common Causes

Missing or Incorrect Firewall Policy

FortiGate processes policies top to bottom.
If there is no allow policy from LAN to WAN, traffic will be denied by default.

NAT Not Enabled in Policy

Even if the policy allows traffic, internet will not work unless NAT is enabled.

Check:

• Outgoing interface = WAN
• NAT = Enabled

Wrong Interface Selection

Policies must match:

• Incoming interface = LAN
• Outgoing interface = WAN

Wrong interface = no traffic match.

Default Route Missing

Without a default route, FortiGate cannot forward traffic to the internet.

Verify:

DNS Not Configured

Clients may have internet but cannot browse.

Check:

• DNS servers on FortiGate
• DHCP DNS settings

Step-by-Step Solution

Step 1: Verify Interface Status

• Check LAN and WAN interfaces
• Ensure they are up and have IP addresses

 Step 2: Check Firewall Policy

• LAN → WAN
• Action: ACCEPT
• NAT: ENABLED

 Step 3: Check Routing

• Default route exists
• Gateway reachable

Step 4: Test Connectivity

• Ping 8.8.8.8 from client
• Ping from FortiGate
• Use policy logs

Best Practices

• Always enable logging while troubleshooting
• Keep policies simple
• Comment policies clearly
• Test after every change

• 

 Common Mistakes

• Forgetting NAT checkbox
• Policy below deny rule
• Wrong interface direction
• Assuming DNS is automatic

 Final Thoughts

When there is no internet behind a FortiGate firewall, the issue is usually related to policy configuration, NAT settings, or routing. Following a structured troubleshooting approach saves time and avoids unnecessary changes.