Correct, I specified both firewalls have an inbound default deny, accept only related/established. The standard CPE configuration for any NAT scenario, and the usual standard for any non-NAT scenario as well. NAT allows me to *bypass* this. -----Original Message----- From: William Herrin <bill@herrin.us> Sent: Thursday, June 18, 2026 2:49 PM To: Gary Sparkes <gary@kisaracorporation.com> Cc: North American Network Operators Group <nanog@lists.nanog.org> Subject: Re: IPv4 flag day On Thu, Jun 18, 2026 at 11:41 AM Gary Sparkes <gary@kisaracorporation.com> wrote:
Simply, the inbound firewall rules prevent it from working.
What inbound firewall rules? The requirement was that the firewalls are identical except for NAT. If there's an inbound firewall rule, it's present on the NAT firewall too. Regards, Bill Herrin -- For hire. https://bill.herrin.us/resume/