Why cant i reach the other network while i have added the routes and firewall rules to allow traffic? (Pfsense/USG200)

Question

I have 2 networks, the current one and the new one. The current one is not configured by me and one big mess and contains heavily out dated hardware (especially servers). I want to be able to access the complete current network from the new one so i can migrate server for server and device for device.

Some network details:

• Current network:
  • IP: 192.168.1.1
  • IP range: 192.168.104.0/24
  • Router/firewall: Zyxel USG200
  • Contain all devices
  • Gives DHCP address to Pfsense (192.168.104.4/24)
• New network:
  • IP: 10.128.10.1
  • IP range: 10.128.10.0/24.
  • Router/firewall: Pfsense
  • Currently it contains only 1 device, my desktop but this network will replace the current one in future
  • All devices will be "moved" from the old to the new network by time (one for one)
  • Connected with old network by port with alias "WAN 2"

I added a route in each firewall to the other network.

• Zyxel: 10.128.10.0/24 via 192.168.104.4
• Pfsense: 192.168.104.0/24 via "WAN2"

I also added a firewall rule to each firewall to allow all traffic from all sources to all destinations (for testing)

When i ping 192.168.104.1 with pfsense diagnostics, i got a response. I cannot find a way to do a ping from the Zyxel to Pfsense but as the route bellow is in the routing table i assume the (at least) routing configuration must be okay.

When i try to ping 192.168.104.1 (or any other device in the 104.x network) from my desktop in the 10.128.10.x network, i got a "request timed out" response. I also cannot SSH or browse to any IP in the 104.x network.

When i connect my desktop to the 104.x network and try to ping 10.128.10.1 or try to visit that IP in my browser (Pfsense web interface) i got "request timed out"

A print screen of my firewall rule on Pfsense (on the desktop interface):

And one from my firewall rule in the Zyxel:

Probably i miss some configuration/settings but i have no idea what. Would be great when someone can help me out with this as i'm already struggling almost 2 days with this. When extra details are required, let me know and i will update my question.

---

UPDATE

My config. I also obfuscated certs and private keys.

<?xml version="1.0"?>
<pfsense>
    <version>19.1</version>
    <lastchange></lastchange>
    <system>
        <optimization>normal</optimization>
        <hostname>axx-psen-wal01</hostname>
        <domain>localdomain</domain>
        <group>
            <name>all</name>
            <description><![CDATA[All Users]]></description>
            <scope>system</scope>
            <gid>1998</gid>
            <member>0</member>
        </group>
        <group>
            <name>admins</name>
            <description><![CDATA[System Administrators]]></description>
            <scope>system</scope>
            <gid>1999</gid>
            <member>0</member>
            <priv>page-all</priv>
        </group>
        <user>
            <name>admin</name>
            <descr><![CDATA[System Administrator]]></descr>
            <scope>system</scope>
            <groupname>admins</groupname>
            <bcrypt-hash>***************************</bcrypt-hash>
            <uid>0</uid>
            <priv>user-shell-access</priv>
        </user>
        <nextuid>2000</nextuid>
        <nextgid>2000</nextgid>>
        <disablenatreflection>yes</disablenatreflection>
        <disablesegmentationoffloading></disablesegmentationoffloading>
        <disablelargereceiveoffloading></disablelargereceiveoffloading>
        <ipv6allow></ipv6allow>
        <maximumtableentries>400000</maximumtableentries>
        <powerd_ac_mode>hadp</powerd_ac_mode>
        <powerd_battery_mode>hadp</powerd_battery_mode>
        <powerd_normal_mode>hadp</powerd_normal_mode>
        <bogons>
            <interval>monthly</interval>
        </bogons>
        <already_run_config_upgrade></already_run_config_upgrade>
        <timezone>Europe/Amsterdam</timezone>
        <language>en_US</language>
        <dnsserver>8.8.8.8</dnsserver>
        <dnsallowoverride></dnsallowoverride>
        <dns1gw>none</dns1gw>
    </system>
    <interfaces>
        <wan>
            <enable></enable>
            <if>igb0</if>
            <blockpriv></blockpriv>
            <blockbogons></blockbogons>
            <descr><![CDATA[WAN1]]></descr>
            <ipaddr>dhcp</ipaddr>
            <dhcphostname></dhcphostname>
            <alias-address></alias-address>
            <alias-subnet>32</alias-subnet>
            <dhcprejectfrom></dhcprejectfrom>
            <adv_dhcp_pt_timeout></adv_dhcp_pt_timeout>
            <adv_dhcp_pt_retry></adv_dhcp_pt_retry>
            <adv_dhcp_pt_select_timeout></adv_dhcp_pt_select_timeout>
            <adv_dhcp_pt_reboot></adv_dhcp_pt_reboot>
            <adv_dhcp_pt_backoff_cutoff></adv_dhcp_pt_backoff_cutoff>
            <adv_dhcp_pt_initial_interval></adv_dhcp_pt_initial_interval>
            <adv_dhcp_pt_values>SavedCfg</adv_dhcp_pt_values>
            <adv_dhcp_send_options></adv_dhcp_send_options>
            <adv_dhcp_request_options></adv_dhcp_request_options>
            <adv_dhcp_required_options></adv_dhcp_required_options>
            <adv_dhcp_option_modifiers></adv_dhcp_option_modifiers>
            <adv_dhcp_config_advanced></adv_dhcp_config_advanced>
            <adv_dhcp_config_file_override></adv_dhcp_config_file_override>
            <adv_dhcp_config_file_override_path></adv_dhcp_config_file_override_path>
            <ipaddrv6>dhcp6</ipaddrv6>
            <dhcp6-duid></dhcp6-duid>
            <dhcp6-ia-pd-len>0</dhcp6-ia-pd-len>
            <adv_dhcp6_prefix_selected_interface>wan</adv_dhcp6_prefix_selected_interface>
            <spoofmac></spoofmac>
        </wan>
        <lan>
            <enable></enable>
            <if>igb1</if>
            <descr><![CDATA[WAN2]]></descr>
            <spoofmac>c1:9b:43:75:5a:65</spoofmac>
            <ipaddr>dhcp</ipaddr>
            <dhcphostname></dhcphostname>
            <alias-address></alias-address>
            <alias-subnet>32</alias-subnet>
            <dhcprejectfrom></dhcprejectfrom>
            <adv_dhcp_pt_timeout></adv_dhcp_pt_timeout>
            <adv_dhcp_pt_retry></adv_dhcp_pt_retry>
            <adv_dhcp_pt_select_timeout></adv_dhcp_pt_select_timeout>
            <adv_dhcp_pt_reboot></adv_dhcp_pt_reboot>
            <adv_dhcp_pt_backoff_cutoff></adv_dhcp_pt_backoff_cutoff>
            <adv_dhcp_pt_initial_interval></adv_dhcp_pt_initial_interval>
            <adv_dhcp_pt_values>SavedCfg</adv_dhcp_pt_values>
            <adv_dhcp_send_options></adv_dhcp_send_options>
            <adv_dhcp_request_options></adv_dhcp_request_options>
            <adv_dhcp_required_options></adv_dhcp_required_options>
            <adv_dhcp_option_modifiers></adv_dhcp_option_modifiers>
            <adv_dhcp_config_advanced></adv_dhcp_config_advanced>
            <adv_dhcp_config_file_override></adv_dhcp_config_file_override>
            <adv_dhcp_config_file_override_path></adv_dhcp_config_file_override_path>
            <ipaddrv6>track6</ipaddrv6>
            <track6-interface>wan</track6-interface>
            <track6-prefix-id>0</track6-prefix-id>
        </lan>
        <opt1>
            <descr><![CDATA[LAN1]]></descr>
            <if>igb2</if>
            <enable></enable>
            <spoofmac></spoofmac>
        </opt1>
        <opt2>
            <descr><![CDATA[LAN2]]></descr>
            <if>igb3</if>
            <enable></enable>
            <ipaddr>192.168.200.1</ipaddr>
            <subnet>24</subnet>
            <spoofmac></spoofmac>
        </opt2>
        <opt3>
            <descr><![CDATA[axn_mgmt]]></descr>
            <if>igb2.5</if>
            <enable></enable>
            <spoofmac></spoofmac>
        </opt3>
        <opt4>
            <descr><![CDATA[axn_intra]]></descr>
            <if>igb2.10</if>
            <enable></enable>
            <ipaddr>10.128.10.1</ipaddr>
            <subnet>24</subnet>
            <spoofmac></spoofmac>
        </opt4>
    </interfaces>
    <staticroutes>
        <route>
            <network>192.168.104.0/24</network>
            <gateway>WAN2_DHCP</gateway>
            <descr><![CDATA[Zyxel compatibility rule]]></descr>
        </route>
    </staticroutes>
    <dhcpd>
        <lan>
            <range>
                <from>192.168.1.10</from>
                <to>192.168.1.245</to>
            </range>
            <dhcpleaseinlocaltime></dhcpleaseinlocaltime>
            <failover_peerip></failover_peerip>
            <defaultleasetime></defaultleasetime>
            <maxleasetime></maxleasetime>
            <netmask></netmask>
            <gateway></gateway>
            <domain></domain>
            <domainsearchlist></domainsearchlist>
            <ddnsdomain></ddnsdomain>
            <ddnsdomainprimary></ddnsdomainprimary>
            <ddnsdomainkeyname></ddnsdomainkeyname>
            <ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
            <ddnsdomainkey></ddnsdomainkey>
            <mac_allow></mac_allow>
            <mac_deny></mac_deny>
            <ddnsclientupdates>allow</ddnsclientupdates>
            <tftp></tftp>
            <ldap></ldap>
            <nextserver></nextserver>
            <filename></filename>
            <filename32></filename32>
            <filename64></filename64>
            <rootpath></rootpath>
            <numberoptions></numberoptions>
        </lan>
        <opt2>
            <range>
                <from>192.168.200.30</from>
                <to>192.168.200.199</to>
            </range>
            <failover_peerip></failover_peerip>
            <defaultleasetime></defaultleasetime>
            <maxleasetime></maxleasetime>
            <netmask></netmask>
            <gateway></gateway>
            <domain></domain>
            <domainsearchlist></domainsearchlist>
            <ddnsdomain></ddnsdomain>
            <ddnsdomainprimary></ddnsdomainprimary>
            <ddnsdomainkeyname></ddnsdomainkeyname>
            <ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
            <ddnsdomainkey></ddnsdomainkey>
            <mac_allow></mac_allow>
            <mac_deny></mac_deny>
            <ddnsclientupdates>allow</ddnsclientupdates>
            <tftp></tftp>
            <ldap></ldap>
            <nextserver></nextserver>
            <filename></filename>
            <filename32></filename32>
            <filename64></filename64>
            <rootpath></rootpath>
            <numberoptions></numberoptions>
            <enable></enable>
            <dhcpleaseinlocaltime></dhcpleaseinlocaltime>
        </opt2>
        <opt4>
            <range>
                <from>10.128.10.30</from>
                <to>10.128.10.199</to>
            </range>
            <enable></enable>
            <failover_peerip></failover_peerip>
            <defaultleasetime></defaultleasetime>
            <maxleasetime></maxleasetime>
            <netmask></netmask>
            <gateway></gateway>
            <domain></domain>
            <domainsearchlist></domainsearchlist>
            <ddnsdomain></ddnsdomain>
            <ddnsdomainprimary></ddnsdomainprimary>
            <ddnsdomainkeyname></ddnsdomainkeyname>
            <ddnsdomainkeyalgorithm>hmac-md5</ddnsdomainkeyalgorithm>
            <ddnsdomainkey></ddnsdomainkey>
            <mac_allow></mac_allow>
            <mac_deny></mac_deny>
            <ddnsclientupdates>allow</ddnsclientupdates>
            <tftp></tftp>
            <ldap></ldap>
            <nextserver></nextserver>
            <filename></filename>
            <filename32></filename32>
            <filename64></filename64>
            <rootpath></rootpath>
            <numberoptions></numberoptions>
            <dhcpleaseinlocaltime></dhcpleaseinlocaltime>
            <dnsserver>8.8.8.8</dnsserver>
        </opt4>
    </dhcpd>
    <dhcpdv6>
        <lan>
            <enable></enable>
            <range>
                <from>::1000</from>
                <to>::2000</to>
            </range>
            <ramode>assist</ramode>
            <rapriority>medium</rapriority>
        </lan>
    </dhcpdv6>
    <snmpd>
        <syslocation></syslocation>
        <syscontact></syscontact>
        <rocommunity>public</rocommunity>
    </snmpd>
    <diag>
        <ipv6nat>
            <ipaddr></ipaddr>
        </ipv6nat>
    </diag>
    <syslog>
        <filterdescriptions>1</filterdescriptions>
    </syslog>
    <nat>
        <outbound>
            <mode>automatic</mode>
        </outbound>
    </nat>
    <filter>
        <rule>
            <id></id>
            <tracker>1589535222</tracker>
            <type>pass</type>
            <interface>lan</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <disabled></disabled>
            <descr><![CDATA[test rule]]></descr>
            <created>
                <time>1589535222</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537043</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589534465</tracker>
            <type>pass</type>
            <interface>opt2</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr></descr>
            <updated>
                <time>1589534465</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </updated>
            <created>
                <time>1589534465</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </created>
        </rule>
        <rule>
            <id></id>
            <tracker>1589536898</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <protocol>icmp</protocol>
            <icmptype>any</icmptype>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr><![CDATA[test rule]]></descr>
            <created>
                <time>1589536898</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537026</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589535642</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <any></any>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr><![CDATA[test rule]]></descr>
            <created>
                <time>1589535642</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537018</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589535105</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <network>opt4</network>
            </source>
            <destination>
                <address>192.168.104.0/24</address>
            </destination>
            <descr><![CDATA[Zyxel compatibility rule]]></descr>
            <created>
                <time>1589535105</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </created>
            <updated>
                <time>1589536984</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589535574</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <network>opt4</network>
            </source>
            <destination>
                <any></any>
            </destination>
            <descr><![CDATA[axn_mgmt to all rule]]></descr>
            <created>
                <time>1589535574</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </created>
            <updated>
                <time>1589537000</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </updated>
        </rule>
        <rule>
            <id></id>
            <tracker>1589534846</tracker>
            <type>pass</type>
            <interface>opt4</interface>
            <ipprotocol>inet</ipprotocol>
            <tag></tag>
            <tagged></tagged>
            <max></max>
            <max-src-nodes></max-src-nodes>
            <max-src-conn></max-src-conn>
            <max-src-states></max-src-states>
            <statetimeout></statetimeout>
            <statetype><![CDATA[keep state]]></statetype>
            <os></os>
            <source>
                <network>opt4</network>
            </source>
            <destination>
                <network>opt4ip</network>
            </destination>
            <descr><![CDATA[axn_intra to axn_intra]]></descr>
            <created>
                <time>1589534846</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </created>
            <updated>
                <time>1589536973</time>
                <username><![CDATA[[email protected] (Local Database)]]></username>
            </updated>
        </rule>
        <separator>
            <opt2></opt2>
            <opt4></opt4>
            <lan></lan>
            <wan></wan>
        </separator>
    </filter>
    <shaper></shaper>
    <ipsec></ipsec>
    <aliases></aliases>
    <proxyarp></proxyarp>
    <cron>
        <item>
            <minute>1,31</minute>
            <hour>0-5</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 adjkerntz -a</command>
        </item>
        <item>
            <minute>1</minute>
            <hour>3</hour>
            <mday>1</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.update_bogons.sh</command>
        </item>
        <item>
            <minute>1</minute>
            <hour>1</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.dyndns.update</command>
        </item>
        <item>
            <minute>*/60</minute>
            <hour>*</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot</command>
        </item>
        <item>
            <minute>30</minute>
            <hour>12</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.update_urltables</command>
        </item>
        <item>
            <minute>1</minute>
            <hour>0</hour>
            <mday>*</mday>
            <month>*</month>
            <wday>*</wday>
            <who>root</who>
            <command>/usr/bin/nice -n20 /etc/rc.update_pkg_metadata</command>
        </item>
    </cron>
    <wol></wol>
    <rrd>
        <enable></enable>
    </rrd>
    <load_balancer>
        <monitor_type>
            <name>ICMP</name>
            <type>icmp</type>
            <descr><![CDATA[ICMP]]></descr>
            <options></options>
        </monitor_type>
        <monitor_type>
            <name>TCP</name>
            <type>tcp</type>
            <descr><![CDATA[Generic TCP]]></descr>
            <options></options>
        </monitor_type>
        <monitor_type>
            <name>HTTP</name>
            <type>http</type>
            <descr><![CDATA[Generic HTTP]]></descr>
            <options>
                <path>/</path>
                <host></host>
                <code>200</code>
            </options>
        </monitor_type>
        <monitor_type>
            <name>HTTPS</name>
            <type>https</type>
            <descr><![CDATA[Generic HTTPS]]></descr>
            <options>
                <path>/</path>
                <host></host>
                <code>200</code>
            </options>
        </monitor_type>
        <monitor_type>
            <name>SMTP</name>
            <type>send</type>
            <descr><![CDATA[Generic SMTP]]></descr>
            <options>
                <send></send>
                <expect>220 *</expect>
            </options>
        </monitor_type>
    </load_balancer>
    <widgets>
        <sequence>system_information:col1:open:0,interfaces:col2:open:0,netgate_services_and_support:col2:open:0</sequence>
        <period>10</period>
    </widgets>
    <openvpn></openvpn>
    <dnshaper></dnshaper>
    <unbound>
        <enable></enable>
        <dnssec></dnssec>
        <active_interface></active_interface>
        <outgoing_interface></outgoing_interface>
        <custom_options></custom_options>
        <hideidentity></hideidentity>
        <hideversion></hideversion>
        <dnssecstripped></dnssecstripped>
    </unbound>
    <revision>
        <time>1589537382</time>
        <description><![CDATA[[email protected] (Local Database): Firewall: Rules - deleted a firewall rule.]]></description>
        <username><![CDATA[[email protected] (Local Database)]]></username>
    </revision>
    <cert>
        <refid>5ebe5df4744c4</refid>
        <descr><![CDATA[webConfigurator default (5ebe5df4744c4)]]></descr>
        <type>server</type>
        <crt>********************==</crt>
        <prv>********************==</prv>
    </cert>
    <ppps></ppps>
    <gateways>
        <defaultgw4>WAN1_DHCP</defaultgw4>
        <defaultgw6></defaultgw6>
    </gateways>
    <vlans>
        <vlan>
            <if>igb2</if>
            <tag>5</tag>
            <pcp></pcp>
            <descr><![CDATA[axn_mgmt]]></descr>
            <vlanif>igb2.5</vlanif>
        </vlan>
        <vlan>
            <if>igb2</if>
            <tag>10</tag>
            <pcp></pcp>
            <descr><![CDATA[axn_intra]]></descr>
            <vlanif>igb2.10</vlanif>
        </vlan>
    </vlans>
</pfsense>

---

UPDATE 2

The diagram bellow should help to understand my situation.

Answer 1

Your config has <blockpriv/> which (I believe) will NOT allow requests OUT to 192.168.104.0 via WAN... and will NOT allow requests IN to 10.128.10.0.

I would also check for a similar setting in the other router... as ALL brands (in theory) BLOCK local addresses on WAN by default.

Otherwise, a nefarious party could externally advertise 192.168.0.1 as being on their network... some sloppy AT&T routers somewhere would likely pick that up and suddenly the hacker is getting inbound traffic from unsuspecting hard-coded ioT devices etc.

Answer 2

As we where not able to solve the issue, we decided to do a "big bang". We connected all devices from the old network one by one to the new network as we could not get it done to run both (the old and the new) networks parallel.

This made the transition not as smooth as we hoped we could do but we saw no other option.

Answer 3

All IP Sub-nets connected with a specific Interface should be able able to reach there Next-Hop or Firewall Interface or Gateway First.

Can you confirm whether while connecting your system in New Series, you are able to reach your next hop IP that is the IP Of Firewall Interface in this case ?

Answer 4

Configuration Looks fine as per Diagram shared. However you can check whether you have enabled nating in Firewall Routes for the Local Policy. If so disable Nating in the Firewall Policy.

Check Firewall Setting in your Computer & Turn it Off.

You May Try with Specific Policies containing Source & Destination IP Series .