TMG Inbound rule/network does't apply

Question

Hello,
I'm having some issues with my 'non-web server protocol publishing rule' and a Network rule. I'm trying to setup acccess from www to a local ftp.
I've created a rule mentioned above, but this doesn't work, because the 'Network rules do not allow the conn..'
I have following Network rules in place:
1: Source Network (SN): Local host, Destination Network (DN)
All Networks (and Local Host), [route]
2: SN: FTP, DN: External 
[nat]
3: SN: External, DN: FTP
[route]
So, in 'my world' there should be access from external Networks to the FTP Network, but still I see connections blocked in the log?
Can I ask for some advice..
best regards
Jesper Vindum, Denmark

Answer 1

Hi,
Actually, it is impossible that the relationship between two networks is the NAT and Route at the same time.
For example, let us assume that there is a customer located in perimeter. This customer access a FTP server depends on the routing relationship between external and perimeter. Meanwhile,
he would like to access the external website which requires relationship between external and perimeter is NAT. At this time, we find something conflict.
Based on
RFC 1918, private IP cannot be routed on internet. So if the IP addresses in perimeter are private IPs and the relationship between external and perimeter is route, customer located in perimeter cannot access internet even if configuration and anything
else is completely right, because ISP would block all the traffic which has a private source IP address. 
In addition, if you configure two network rules for the two same object (for example, rule 2 and rule 4 in your sketch), TMG hits the rule which is close the top of the list.
Best Regards
Quan Gu