How can I allow a user to SSH to his UNIX box from home? Can I set it up so when his home address (and only HIS home address) SSH to my external address he will forward right to his machine?
I suggest to use an identity based policy in which you use the VIP. Just add a user group (with just one user) to the source field (formerly: source address field) in the policy.
Only if your user has got a fixed public address you might use it to identify your user.
1- VIP: external addr: free public address, mapped to addr: private ssh_server_IP, external/mapped to port: tcp/22
2- policy: either
src addr: any AND usergroup: this_user
src addr: fixed home office address
dest addr: VIP, service: SSH
I suggest using an identity-based policy in which you use the VIP with customized SSH port on the public network.This article will help you.
Generally it is very difficult to create a rule for someones home IP address as they change from time to time. It can be done but be prepared for users to complain every time they get a new IP and the Policies no longer work. From a security perspective direct SSH access from "any" can open you up to a lot of potential issues, brute force attacks etc. Not something I would recommend. Changing the service to a non-standard port is also not recommended because the service can be fingerprinted and identified by tools like NMAP, and other port scanners.
Using SSL VPN for remote access to internal resources is the answer, in my opinion.
If it's a public server, VIP + policy SSH with source ip (home).If it's a private server. Client IPsec or client SSL VPN w native - or FortiClient.
In the policy SSH as service. Add IPS and AV in the policy since this is a home user = no ctrl over home environment.
IPsec VPN with FortiClient - Fortinet Cookbook
SSL VPN using web and tunnel mode - Fortinet Cookbook