> Source: [sk184176](https://support.checkpoint.com/results/sk/sk184176)

# sk184176 - Security Gateway does not match traffic to the rule with a Security Zone after an upgrade to R82 or higher

| Property | Value |
|----------|-------|
| Solution ID | sk184176 |
| Date Created | 2025-10-23 |
| Last Modified | 2025-10-29 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82 |
| OS | Gaia |

## Symptoms

- * Security Gateway drops traffic on a Clean Up rule, although there is an explicit "Accept" rule that contains a Security Zone object in the Destination column.

* Kernel debug on the Security Gateway (`fw ctl debug -m fw route`) shows:

  `route_conn_app_get_os_route: fw_os_route_get_ipin_route failed;`  
  `
  fw_os_route_get_out_ifn: route_conn_app_get_os_route failed;`
* The issue started after an upgrade of the Security Gateway to R82 (or higher).

## Cause

Version R82 runs the Linux kernel 4.18. Versions R80.40 - R81.20 run the Linux kernel 3.10.

Comparing to the Linux kernel 3.x, the Linux kernel 4.x performs several additional checks during source-based routing for the connections.

These checks may affect traffic flows related mostly to the configured Check Point "Security Zones" in this scenario:

1. NAT is configured for the traffic destination as "Hide behind Gateway".
2. Policy-Based Routing (PBR) is configured on the Security Gateway.

Chain of events:

1. When the NAT is configured as "Hide behind Gateway", the source IP address of the routed traffic is the real IP address of the Security Gateway.
2. When PBR is configured, the Security Gateway performs source-based routing for the relevant connections.
3. By default, the Linux kernel 4.x discards IPv4 packets that have a source IP address that belongs to the Security Gateway to improve security.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content