I have a Sophos UTM with v9.712-13. I understand from Rule #2 in " rulz " that DNAT is evaluated before the firewall rules: the connection tracker (conntrack) first then Country Blocking then the 'ICMP' tab in 'Firewall': Traceroute and Ping…