Port-Only DNAT Fails for Route-Based VPN Return Traffic

Products

• VMware NSX

Issue/Introduction

When a Destination NAT (DNAT) rule is configured for port-only translation (identical Destination and Translated IP addresses) on traffic traversing a route-based IPSec VPN, the following symptoms occur:

• Forward traffic (e.g., Client → Server on Port 22 → 2222) succeeds.
• Return traffic (Server → Client) reaches the client with the translated source port (2222) rather than being reverted to the original port (22).
• The client terminates the connection with a TCP RST because the source port does not match the expected port from the SYN request.
• Packet logs show connections stuck in SYN_SENT until timeout (~32s).

Environment

VMware NSX

Cause

This issue has been identified as a product limitation in the NSX Edge datapath handling.

When DNAT is performed on the downlink interface as a packet enters the gateway, but the response traffic returns via a Virtual Tunnel Interface (VTI), the NAT engine fails to effectively revert the port translation for identical IP scenarios.

Resolution

No Resolution available at the moment enginerring workingon enhancement.

Workaround:

Client-Side Redirection: 

The only confirmed workaround is to perform the port or IP redirection locally on the client using utilities such as iptables (Linux) or equivalent firewall tools. This ensures the traffic leaves the client already destined for the correct backend port, bypassing the need for Gateway-level DNAT.