Sketchy response on WAN network port

Question

I've got a Mac Mini Snow Leopard Server. The built in ethernet is plugged into a switch that is outside the firewall the network is something like;
IP : nn.nn.nn.23
SUBNET: 255.255.255.240
Gateway: nn.nn.nn.17
It plays well with my two other servers on the same network, nn.nn.nn.29 and nn.nn.nn.30. Ping, traceroute and portscans fine. It plays well on the internet in general with predictable responses. The problem comes in when I try to access the machine from my LAN through our NAT firewall. 192.168.1.0/24 goes out to 192.168.1.n and gets transformed to nn.nn.nn.19. I cannot get a response from the server. I know there's no fundamental routing flaw as the two other servers on the nn.nn.nn.16/28 network are very functional from the LAN through the exact same switch/router/firewall path. There seems to be something unique about the way 10.6.5 tries to respond. I wonder if the server is not responding TO the port that the connection came FROM. That would baffle the NAT tables. I'm not getting anything in the NAT firewall logs to indicate any kind of misguided response. The only other thing I can imagine is that 10.6.5 is somehow responding to nn.nn.nn.19 as a router and not as a host. Anyone seen this behavior before? I hope to work around the issue by setting up a second network on the LAN and having everything stay inside the FW but the inability to create static routes only allows me to do that with one of my 3 subnets so I'm trying to figure that out as well.
Message was edited by: neotrog

Answer 1

In no particular order, can you get rid of all those addresses and post with made-up names or such and with what works and what does not work.
Having to back-translate 19 to router and 23 to the host or whatever is making my head hurt.
You have an inside host, a NAT gateway box, and an outside host.
Inside host via NAT gateway to the rest of the world works, right?
Inside host via NAT gateway to outside host works, too, right?
What doesn't work is outside host via ARP or via its gateway routing via NAT gateway to inside host, right?
And are you using public or private addresses for your outside host outside your NAT gateway?
Are your outside host and your NAT gateway in the same subnet? (Your outside host would have to send to the NAT address, and get port-forwarded. (Possibly via the IP gateway used by the outside host, depending on how smart your NAT gateway box is.)
And FWIW, there is no particular difference between a router and a non-routing host as far as the packets are concerned; it's all IP addresses to them.