External connectivity to NSX Overlay VM via DNAT fails due to unattached segment and NAT rule precedence conflict.

Products

• VMware NSX

Issue/Introduction

External network connectivity to an NSX Overlay virtual machine via its assigned Destination NAT (DNAT) IP cannot be established.

Symptoms:

• External packets do not reach the internal virtual machine despite no firewall blocks.
• SNAT (Outbound) traffic works, but DNAT (Inbound) fails.
• NSX Traceflow confirms traffic matches an unintended NAT rule.
• Tier-1 Edge packet captures show translation to an incorrect internal IP.

Environment

• VMware NSX-T
• VMware Cloud Director (vCD)

Cause

This connection failure is the result of a two-fold configuration issue:

1. Disconnected Segment: The logical segment hosting the virtual machine was initially unattached, preventing valid internal routing.

2. NAT Rule Precedence Conflict: After the routing path was restored, the NSX NAT engine processed the incoming traffic but encountered overlapping rules. The environment contained two separate DNAT rules matching the exact same external ingress traffic criteria (e.g., same external IP and port).

Both conflicting rules were configured with the exact same priority level (50). In the NSX datapath, when NAT rules tie in priority, the rule that was created first takes precedence. Because the unintended legacy rule was older, it aggressively intercepted the traffic and translated the destination to the wrong internal IP address.

Resolution

To restore connectivity, perform these steps:

1. Map the disconnected overlay segment to the appropriate Tier-1 gateway. If using VMware Cloud Director, ensure the mapping matches the vCD network configuration.
2. Navigate to the NSX NAT rule table for the affected Tier-1 gateway.
3. Identify the stale/conflicting legacy DNAT rule that is intercepting the traffic.
4. Disable or delete the conflicting rule to allow the correct rule to match the incoming traffic.