I am currently configuring a ubiquity edgerouter for our network. We have one uplink port (eth2) and two internal ports (eth0; with vlan 1) and eth3 (with vlans 2,3 and 4). uplink and vlan 1 have public IPs. vlans 2-4 use internal (192.168.0.0/16) IPs. All Traffic coming in from vlans 2-4 is NATed to a public IP. I have zone based firewalling and each vlan + uplink has its own zone.
I have all firewall rules set up so that the hosts in vlan 2-4 can e.g. ping the internet but they can't. The hosts on eth0.1 don't get NATed and they can ping the public internet.
I traced the problem down to the following: When I tcpdump on eth2 I see the NATed package going out and the reply comming in followed by a ICMP port unreachable send out. When I add LOG entries into mangle/PREROUTING and nat/PREROUTING I see the reply package come by the End of mangle/PREROUTING but not the beginning of nat/PREROUTING. I was not able to find out what motivates the kernel to reject the package between these two chains. I found multiple Variation of the iptables flow (e.g. on wikipedia) and they all state nothing between these chains.
Can someone tell me what might reject these packages?