Zywall keeps blocking my server outgoing traffic

vfm_IT

I have a server IP:192.168.20.2 in LAN1

Zywall USG110 (Version V4.33(AAPH.0)) keeps block outgoing traffic from that server.

All other PCs on LAN1 don´t have this issue.

I even created a security policy to allow outgoing traffic from my server and I gave that policy priority #1. but It bypass that policy.

I am sharing Log, Policy security and some more.

Please help me.

Screenshot 2019-07-04 at 10.16.43 AM.png

Screenshot 2019-07-04 at 10.17.21 AM.png

Screenshot 2019-07-04 at 10.17.54 AM.png

Screenshot 2019-07-04 at 10.18.22 AM.png

Screenshot 2019-07-04 at 10.18.58 AM.png

PeterUK

You can improve the logs by hovering over the columns for be down arrow to add Source Interface.

PeterUK

Most odd is the gateway for LAN1 192.168.20.1 subnet 255.255.255.0?

Is their anything more in the logs that might help without the filter?

Have you made a routing rule from LAN1 to next hop WAN1 by SNAT?

imaohw

Are you sure the server is on Lan1?

PeterUK

You can improve the logs by hovering over the columns for be down arrow to add Source Interface.

Zyxel_Cooldia

Hi @vfm_IT

Can you post the following CLI result for checking.

Router> show zone user-define

Router> show zone system-default

vfm_IT

@PeterUK

Your comment was a great help for me.

But I can not figure out why the zyxel consider my server 192.168.20.2 is member of LAN2 (see attachment)

Screenshot 2019-07-06 at 12.55.59 PM.png

While my LAN1 is 192.168.20.X/255.255.255.0 and my LAN2 is 191.168.X.X/255.255.0.0 (see attachment as a proof)

Screenshot 2019-07-06 at 12.59.49 PM.png

I have to create a specific policy rule to make the zyxel allow outgoing access for my server 192.168.20.2 (see attachment as a proof)

Screenshot 2019-07-06 at 1.02.21 PM.png

Screenshot 2019-07-06 at 1.02.33 PM.png

Can someone explain why? is this a bug on the zyxel router?

vfm_IT

@Zyxel_Cooldia

Hello

Please find print screen attached

Screenshot 2019-07-06 at 1.08.51 PM.png

PeterUK

What port is the server connected too on the USG110?

How has port role setup?

Zyxel_Cooldia

Hi @vfm_IT

It seems host 192.168.20.2 goes to wrong interface.

Can you get the CLI “show arp-table” to check where the host 192.168.20.2 come from? 

Show arp table

vfm_IT

@PeterUK

Thanks for your help.

I have been able to identify the issue and fix it.

My server was connected on LAN2 and that´s why the USG was blocking outgoing traffic from my server.