I don't think you need the source NAT for trust to DMZ connetivity.
rule-set trust-to-DMZ {
from zone trust;
to zone DMZ;
rule trust-to-DMZ {
match {
source-address 0.0.0.0/0;
destination-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
I don't get that static nats with a source of trust but external IP address space, you already have these in the untrust statics.
rule-set static-nat-trust {
from zone trust;
rule whistler-2 {
match {
destination-address 156.17.123.2/32;
}
then {
static-nat prefix 192.168.1.2/32;
}
}
rule liber-2 {
match {
destination-address 156.17.123.3/32;
}
then {
static-nat prefix 192.168.1.3/32;
}
}
rule diablo-2 {
match {
destination-address 156.17.123.4/32;
}
then {
static-nat prefix 192.168.1.4/32;
}
}
}
}
Finally, you have no policy from untrust to trust for 192.168.0.30/32.
