Port forwarding not working on MX67

[svenus1977]

My WAN 1 is down so using WAN 2 to test but that should not affect outcome. 

Have configured port forwarding on matching both links, LAN server confirmed is active.

Done a packet capture on both sides, it appears that MX has dropped the SYN/ACK from the server and therefore 3-way handshake not completed.

Removed all firewall rules (actually the rules are not blocking anyway), still the same.  Any idea why MX is dropping the SYN/ACK only for port forwarding traffic?  

Other outbound traffic is fine. 

[svenus1977]

Found the fix myself. That VLAN if I enable AutoVPN, the port forwarding fails. 

Port forwarding works once I turn off AutoVPN.  Not exactly sure how the two interacts but I may perhaps configure another VLAN for the AutoVPN.

[alemabrahao]

It does not make sense. Have you opened a support case?

[svenus1977]

No, it doesn't look right to me neither. I'll try to see the best option I have now, given that I am using a workaround for production traffic, falling back to the non-working config for troubleshooting is a bit challenging. 

[PhilipDAth]

Are you doing a full tunnel for AutoVPN?  That would break it.

[svenus1977]

I'm doing split tunnel, that's why I haven't thought of turning it off until I run out of options and give it a try.  By the way, I have multiple VLANs, I just need to turn off AutoVPN for that particular VLAN that needs port forwarding to map to.  I can still keep the other required VLAN participating AutoVPN.