Vyatta Destination NAT não está funcionando

Estamos enfrentando um problema ao adicionar novos IPs a um dispositivo vyatta depois de exceder o limite de IPs em nosso primeiro grupo VRRP. Todos os IPs listados no vrrp-group 1trabalho funcionam bem, mas qualquer um que eu adicionar vrrp-group 2não funciona.

Podemos ver o tráfego chegando, mas o tráfego que queremos trabalhar (443) nunca atinge o NAT. No entanto, o tráfego de ping entra e retorna (o que não deve funcionar). O NAT vem antes do firewall, mas verificamos isso para ter certeza de que não está faltando nada e tem 0 acertos. Qualquer ideia seria muito apreciada.

O tráfego entra na porta 443, mas não sai

tcpdump: listening on bond1, link-type EN10MB (Ethernet), capture size 65535 bytes
12:07:50.003063 IP (tos 0x0, ttl 52, id 63499, offset 0, flags [DF], proto TCP (6), length 64)
2.2.2.2.62111 > 1.1.1.1.443: Flags [S], cksum 0xd629 (correct), seq 237589496, win 65535, options [mss 1380,nop,wscale 5,nop,nop,TS val 1539048232 ecr 0,sackOK,eol], length 0
12:07:50.709156 IP (tos 0x0, ttl 52, id 37525, offset 0, flags [DF], proto TCP (6), length 64)
2.2.2.2.62113 > 1.1.1.1.443: Flags [S], cksum 0x412b (correct), seq 2830126052, win 65535, options [mss 1380,nop,wscale 5,nop,nop,TS val 1539048881 ecr 0,sackOK,eol], length 0
12:07:57.131533 IP (tos 0x0, ttl 52, id 34718, offset 0, flags [DF], proto TCP (6), length 64)
2.2.2.2.62137 > 1.1.1.1.443: Flags [S], cksum 0xc2c7 (correct), seq 3549136583, win 65535, options [mss 1380,nop,wscale 5,nop,nop,TS val 1539055166 ecr 0,sackOK,eol], length 0

Nada na tabela NAT de acertos do Firewall

sh nat destination translations | match 1.1.1.1

sh firewall name out2in rule 100

-----------------------------
Rulesets Information
-----------------------------

IPv4 Firewall "out2in":

Active on traffic to -
zone [inside] from zone [outside]

rule action proto packets bytes
---- ------ ----- ------- -----
100 accept tcp 0 0
condition - saddr 0.0.0.0/0 daddr 10.0.0.100

Ping funciona (mas não traduz)

15:11:31.052571 IP (tos 0x0, ttl 52, id 65344, offset 0, flags [none], proto ICMP (1), length 84)
    2.2.2.2 > 1.1.1.1: ICMP echo request, id 28473, seq 117, length 64
15:11:31.052585 IP (tos 0x0, ttl 64, id 9409, offset 0, flags [none], proto ICMP (1), length 84)
    1.1.1.1 > 2.2.2.2: ICMP echo reply, id 28473, seq 117, length 64
15:11:32.055675 IP (tos 0x0, ttl 52, id 32001, offset 0, flags [none], proto ICMP (1), length 84)
    2.2.2.2 > 1.1.1.1: ICMP echo request, id 28473, seq 118, length 64

NAT

set nat destination rule 100 destination address '1.1.1.1'
set nat destination rule 100 destination port 'https'
set nat destination rule 100 inbound-interface 'bond1'
set nat destination rule 100 protocol 'tcp'
set nat destination rule 100 translation address '10.0.0.100'

Firewall

set firewall name out2in rule 100 action 'accept'
set firewall name out2in rule 100 destination address '10.0.0.100'
set firewall name out2in rule 100 destination port '443'
set firewall name out2in rule 100 protocol 'tcp'

Configuração VRRP

set interfaces bonding bond1 address '1.1.1.4/28'
set interfaces bonding bond1 hash-policy 'layer3+4'
set interfaces bonding bond1 mode '802.3ad'
set interfaces bonding bond1 vrrp vrrp-group 1 advertise-interval '1'
set interfaces bonding bond1 vrrp vrrp-group 1 preempt 'false'
set interfaces bonding bond1 vrrp vrrp-group 1 priority '253'
set interfaces bonding bond1 vrrp vrrp-group 1 'rfc3768-compatibility'
set interfaces bonding bond1 vrrp vrrp-group 1 sync-group 'vgroup1'
set interfaces bonding bond1 vrrp vrrp-group 1 virtual-address '1.1.1.230/28'
set interfaces bonding bond1 vrrp vrrp-group 1 virtual-address '1.1.2.80/28'
set interfaces bonding bond1 vrrp vrrp-group 1 virtual-address '1.1.3.172/29'
...
set interfaces bonding bond1 vrrp vrrp-group 2 advertise-interval '1'
set interfaces bonding bond1 vrrp vrrp-group 2 preempt 'false'
set interfaces bonding bond1 vrrp vrrp-group 2 priority '253'
set interfaces bonding bond1 vrrp vrrp-group 2 'rfc3768-compatibility'
set interfaces bonding bond1 vrrp vrrp-group 2 sync-group 'vgroup1'
set interfaces bonding bond1 vrrp vrrp-group 2 virtual-address '1.1.1.1/28'

Adicionada nova subinterface à política de zona

set zone-policy zone outside interface 'bond1'
set zone-policy zone outside interface 'bond1v1'
set zone-policy zone outside interface 'bond1v2'

A rota corresponde a rotas semelhantes em bond1v1

1.1.3.172/28 is directly connected, bond1v1
1.1.1.1/28 is directly connected, bond1v2