DNAT Policy Configured for Specific Port Unexpectedly Allows Traffic on Original Port

Products

• VMware Cloud Director

Issue/Introduction

• Problem with firewall rules on Edge.
• Administrators may encounter a scenario where a Destination NAT (DNAT) policy is created on an Edge Gateway to map a specific external port (e.g., 53389) to an internal service.
• However, testing reveals that the destination allows traffic on both the translated port (53389) and the original default port (e.g., RDP port 3389).
• Network connectivity tests confirm that the destination accepts connections on both the intended custom port and the standard service port.

Environment

VMware Cloud Director 10.6.1.2

Cause

This behavior is caused by the configuration of the Firewall Match setting within the NAT rule options in conjunction with port definition. If a DNAT rule is defined with specific IP addresses but no specific ports (implying "Any"), the rule matches all traffic destined for that IP, regardless of the port.

Resolution

To workaround the issue, follow Method 1 Resolution from the below KB:

NSX-T: DNAT Policy Configured for Specific Port (53389) Unexpectedly Allows Traffic on Original Port (3389)