> Source: [sk34160](https://support.checkpoint.com/results/sk/sk34160)

# sk34160 - "Connection contains real IP of NATed address" log when packets are dropped on the internal or external interface

| Property | Value |
|----------|-------|
| Solution ID | sk34160 |
| Date Created | 2008-01-13 |
| Last Modified | 2019-12-27 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- "`Connection contains real IP of NATed address`" log when packets are dropped on the internal or external interface of Security Gateway.  

Possible Scenario: System in internal network connecting to the Internet, but internal routers had no route back to the client originating the connection, so the SYN-ACK hits the gateway via the default route.

## Cause

**If traffic is dropped on internal interface:**

The Security Gateway receives traffic from the internal network sent towards the outside, which contains a translated internal IP address as the destination address. The Security Gateway sends the traffic back to the source's MAC address in the internal network and then drops it with the above error message.

**If traffic is dropped on external interface:**

Security Gateway sent traffic towards the outside. Due to the wrong configuration (e.g., routing loop), upstream router sends the traffic towards the Security Gateway with the internal addresses as the destination, rather than the with the NATed addresses.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content