Fortigate Firewall – Web-Filter Not Working on Fortigate 300C

After Site 2 opens the VPN tunnel it should be assigned an IP, e.g. 10.10.10.2, and a route should appear on the router (acting as VPN Server) pointing to this IP.

You can use Destination NAT instead of policy routing, by matching all traffic whose destination is the public IP X.Y.Z.W, and that are incoming only from the router LAN Interface, and NATTing the destination to 10.10.10.2.

This will route all traffic going to Site 2 through the VPN tunnel automatically, and it will hit the public host.

GRNET (the Greek Research and Education network) have developed a web application for customers to do this with Flowspec. The web portal has a BGP Flowspec backend which injects flowspec into your network. Highly configurable and in use on the 500-1,000 Gbps pan-European GEANT backbone: https://www.noc.grnet.gr/en/fod