PeterUK  Guru Member

Well maybe Zyxel can come up with another way...like a device that connects to your network that links up to the Nebula without port forwarding but has all the settings like standalone...

Just use Flex 500 in standalone mode

The router would be needed with the VLAN for that subnet

For a start you used Source Port which likely will not match the outgoing traffic based on the ports you have put in and use the default SNAT post a picture of Policy Route also you say 15 IPs starting at 50.50.50.10 yet NAT shows 50.50.50.1 and 50.50.50.2

I have done a setup you need see my post. https://community.zyxel.com/en/discussion/comment/49460/#Comment_49460

set LAG on firewall to L3 (SrcIP/DstIP / L4 (SPORT/DPORT/PROTO) that will give you more download speed on a threaded download

Yes routing and move it to the top rule do not add ports to the rule

Your could get two L2+ switches for each subnet link them together have PC gateway to them and add some routing rules then it be port speed fast or get a faster USG.

I'm a bit lost too with SNAT Status and Policy Route. The NAT looks fine... So...delete all SNAT Status and Policy Route and strat over You want 10.10.10.10 to SNAT 50.50.50.10 so do for routing interface LAN for source 10.10.10.10 destination any and port any next hop ge8 SNAT 50.50.50.10 Do the same for the others make…

Mind you thats upload limit from PC to switch LAG with MAC based so it be this FW FortiGate LAG algorithm thats for download speed across the ports.

The limitation is the LAG algorithm being MAC based you be limited to 1Gb. Other switches I know of do like Src/Dest IP and TCP/UDP port. I would like to see Zyxel do a algorithm that is least loaded or where by packets are evenly sent down the ports

Do you know what IP is on the WAN currently? if it different to you WAN block of IP's then setup LAN2 with like 5.0.0.1/26 your devices will get WAN IP's on LAN2 then SNAT none route LAN2 to WAN. Any incoming traffic should be forwarded by the provider to WAN IP/MAC of Zywall and routed to LAN2.

I have a setup like this it make hard time working out problems. On Outbound Traffic source NAT you have source subnet the same size as SNAT? And changed Destination NAT?

…hmm ok maybe do a packet capture on WAN to see if ARP is working correctly.

One way is your ISP gives you a IP on WAN different to your subnet and you put your subnet on LAN1 then do a routing rule LAN1 to WAN SNAT none.