221196

The routing mode of the module is active as well as the NAT option where I have set the external IP address as: 192.168.2.100, the internal IP address as 192.168.0.25 and the direction: External->Internal.

My IP rule in the firewall is as follow:

Allow     External->Internal     SourceIP: 192.168.2.100 DestinationIP: 192.168.0.25

I can ping the external PC from the internal PC without even configuring it. How is it possible?? 

Is there anything I am missing in the configuration?

There is.
With the DST NAT you did here the SCALANCE takes over the EXT IP itself.
Thus this address has to be an unused one (e.g. 2.200) - never the address of an existing device.
Using this you could talk to 2.200 from 2.100 without setting a gateway in the EXT PC, the S would forward all incoming traffic to 0.25.
The firewall rule for NAT would be Allow EXT/INT 2.200 > 2.100, since NAT is done before firewall (in your V2 Scalance that is).

Now with this config you got a duplicated IP 2.100 which both the PC and S have in use.

Thats also the reason your ping from internal "works" - the NAT address of the S answers, not the PC.

> Disable the NAT and try with firewall only, or set the NAT right.

Hello 221196,

Please see my post: https://support.industry.siemens.com/tf/us/en/posts/132309/

You should set the subnet mask of your device correctly.

Best regards,

Hugo 

HugoDufour1

You should set the subnet mask of your device correctly.

 It is nice you understood some IP basics but:

1. There is no "correct" subnet mask - this is solely depending what you want to do.
2. 255.255.253.0 is never a valid mask, since these grow/shrink by the power of two. (252/248/240...)
   
3. Your Scalance S is obviously in Bridged mode which locks both routing and NAT.
   

Might be fine in your setup. Still it is not the intention here, nor does it solve the problem.

Sprawl

HugoDufour1

You should set the subnet mask of your device correctly.

 It is nice you understood some IP basics but:

1. There is no "correct" subnet mask - this is solely depending what you want to do.
2. 255.255.253.0 is never a valid mask, since these grow/shrink by the power of two. (252/248/240...)
   
3. Your Scalance S is obviously in Bridged mode which locks both routing and NAT.
   

Might be fine in your setup. Still it is not the intention here, nor does it solve the problem.

 You add an other level of understanding to my comprehension of subnet mask.

Thank you!

Sorry for you this does not solve your issue.

It solve everything for my application.