This is working as designed. The current FWaaS implementation sees the ip address before it's DNAT'ed, not after it. Changing this would probably be a bigger change, and a feature.
This is working as designed. The current FWaaS implementation sees the ip address before it's DNAT'ed, not after it. Changing this would probably be a bigger change, and a feature.