> Source: [sk120481](https://support.checkpoint.com/results/sk/sk120481)

# sk120481 - Security Gateway drops traffic that was supposed to hidden behind NAT with "Reason: NAT rulematch failed"

| Property | Value |
|----------|-------|
| Solution ID | sk120481 |
| Date Created | 2017-09-15 |
| Last Modified | 2025-07-08 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Security Gateway drops traffic that was supposed to hidden behind NAT.

* Kernel debug on the Security Gateway shows:

  `dropped by fw_first_packet_xlation Reason: NAT rulematch failed`
* Connecting with Telnet from the same source IP address to the same destination IP address and the same destination port works (if the Access Control policy allows and the destination accepts such a connection).

## Cause

1. The dropped connection was sent to one of the destination ports configured in the applicable "`table.def`" file on the Management Server in the kernel table "`hide_behind_low_ports`".  
   The default definition of this kernel table contains these port ranges 512-514 and 515:  
   `hide_behind_low_ports = { <512,514>, <515,515> };`
2. The number of connections to the destination ports configured in the kernel table "`hide_behind_low_ports`" exceeded the number of available NAT ports.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content