Lost UDP natting after 1.38 upgrade on Flex 700H

Delta69 · May 14

Hello,
I have a couple of Flex 700H upgaded from 1.36 to 1.38, with multiple public IP addresses on each of them.
I natted some services managed by appliances connected on the DMZ, among them a SSL VPN working with both TCP and UDP connections on port 443 on one of the public IPs.
Since the upgrade, tunnels using UDP sessions are not working anymore, whereas the TCP ones work fine.
Any idea ?
Thanks.

Delta69 · May 18

Hello Judy / Peter,

I can confirm that everything is back to normal after disabling the QUIC protocol.

Thank you for your help.
Regards

PeterUK · May 14

Not seeing this problem but I'm on V1.38(ABZI.0)ITS-26WK16-m11228

setup as
Client > VPN server Zywall 110 > tunnel FLEX 700H > Server

The Client can DNS by UDP to server over the tunnel fine with routeing rule to SNAT from FLEX 700H LAN gateway IP

Its a bit unclear of your setup to go on

Delta69 · May 14

Thanks for your reply,

On our side we are using firmware V1.38(ABZI.0) | 2026-04-09 08:23:09

Sorry if I was a bit unclear, the issue is not related to DNS but it's related to SSL VPN tunnels based on UDP that are now failing to establish.

Regards

PeterUK · May 15

I don't think FLEX H supports the SSL VPN by openVPN over UDP for the tunnel…

Delta69 · May 15

Well, SSL VPN is done by an appliance on the DMZ. The firewall is just passing the traffic (and it was working perfectly until v1.38 firmware upgrade).

PeterUK · May 15

just to be clear your talking about this setting

Delta69 · May 15

There shouldn't be any connection with the firewall's OpenVPN module, which isn't being used (and is disabled): the firewall is simply redirecting TCP and UDP network traffic to a third party VPN server in the DMZ.
Thank you very much for your help.

PeterUK · May 15

hmm so what happens if you change the SSL VPN port on FLEX H that your not using?

or is SSL VPN port 10443 and you need 443 what the FLEX H has for UI?

It might be caused by this

https://community.zyxel.com/en/discussion/32798/the-block-quic-protocol-bug

however the setting is a bit buggy to disable in system > advanced disable Block QUIC Protocol

Delta69 · May 15

Yes, maybe it's the same bug, IMHO it's on the NATing side because the rule is not triggered anymore in the Network Policies… (0 hits since the FW upgrade).
BTW, we are using port 443 and the embedded SSL VPN server has 10443 configured.