> Source: [sk184768](https://support.checkpoint.com/results/sk/sk184768)

# sk184768 - RSH connections fail when Destination NAT is configured for the RSH server

| Property | Value |
|----------|-------|
| Solution ID | sk184768 |
| Date Created | 2026-03-16 |
| Last Modified | 2026-07-23 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * The `rsh` command fails when Destination NAT (DNAT) is configured for the RSH server.

  <br />

  Note: The command works correctly when DNAT is removed.
* The client successfully establishes the initial TCP control connection (TCP/514) to the server. However, the secondary reverse TCP connection (server ? client) does not complete.

* Packet captures show that the Cleanup rule drops the server-to-client TCP SYN packet.

* The reverse connection is not recognized as part of the existing session.

* The client may display an error similar to:

  `rsh: Didn't receive NULL byte from server: Connection reset by peer`

## Cause

The RSH protocol uses two TCP connections:

* Primary control connection: Client ? Server (TCP/514)
* Secondary reverse connection: Server ? Client (client-side high port)

The Security Gateway uses an RSH protocol handler to dynamically create an anticipation entry, allowing the reverse connection as part of Stateful Inspection.

When Destination NAT is configured for the RSH server:

* The protocol handler creates the anticipation entry using the pre-NAT server IP address.
* After DNAT translation is applied, the reverse connection parameters no longer match the stored anticipation entry.
* The Security Gateway treats the reverse connection as a new session.
* If no explicit Access Control rule matches this traffic, it reaches the Cleanup rule and is dropped.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content