[RayPesek]

After some testing, it turns out it's not a NAT issue at all. It looks like some kind of weird problem with the Provider-1 Multi-Domain GUI. The plain old R65 GUI works most of the time. The shortcut to start the P-1 GUI is

Target: "C:\Program Files\CheckPoint\Provider-1\R65\CPLauncher.exe" 9

Start in: "C:\Program Files\CheckPoint\Provider-1\R65\"

If you go to a command prompt in "C:\Program Files\CheckPoint\Provider-1\R65\" and run

cplauncher 9 <Enter>

it works fine from the Internet. Go figure.

The numeric parameter tells it which program to launch. My guess is cplauncher.exe is not respecting the "Start in" parameter. Why it works when run from the LAN is what's weird.

Ray