Internal traffic fails to trigger DNAT rule when source and destination segments are on the same Tier-1 Gateway.

Products

• VMware NSX

Issue/Introduction

• A Destination NAT (DNAT) rule is configured on a Tier-1 Gateway to map an External IP to an Internal Service IP.
• External traffic (North-South) successfully hits the DNAT rule and reaches the service.
• Internal traffic originating from a VM within the same NSX environment fails to trigger the DNAT rule and cannot reach the service via the External IP.
• Traceflow analysis shows the traffic is delivered directly from the source VM to the destination segment via the Distributed Router (DR), bypassing the NAT engine entirely.

Environment

VMware NSX

Cause

In NSX architecture, NAT is a stateful service that resides on the Services Router (SR) component of a Gateway. When the source and destination segments are attached to the same Tier-1 Gateway, the traffic is handled as East-West traffic by the Distributed Router (DR) component on the local host.

Because the DR handles the routing locally to optimize performance, the traffic never traverses the centralized SR component where the NAT rules are evaluated. Consequently, the DNAT rule is never triggered for purely internal traffic between these segments.

Resolution

To force internal traffic to evaluate the DNAT rule, the traffic must be forced to traverse the Services Router (SR).

1. Separate Routing Boundaries: Move the source segment to a different Tier-1 Gateway than the destination segment.
   • This forces the traffic to route from the source Tier-1, up to the Tier-0, and back down to the destination Tier-1.
   • As the traffic enters the destination Tier-1 Gateway from the "outside" (the Tier-0), it hits the SR component and triggers the DNAT rule.
2. Verify via Traceflow: After the change, run a new Traceflow. You should now see the traffic hitting the "NAT" logical observation point on the Tier-1 Gateway.