Strange Firewall rules or something not understood

Sounds like an issue with which happens first (rule or NAT), and I think NAT happens before anything else? And you're doing PNAT so that the destination port is no longer PRO_RDP.

Or is it the other way around? It can be counter-intuitive.

Thank you for your answer.

I don't have much experience but how is this possible
NAT must be possible only if the firewall rule allows it
Also I don't actually do PNAT because RDP stay RDP ???

If it doesn't work that way how to only allow RDP to this server on the LAN ?

Regards

I'm still thinking the note (from https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/NATRules/index.html#load-balancing) might apply:

Incoming traffic: Sophos Firewall looks up the DNAT rule first to determine the translated (post-NAT) destination. It then matches the firewall rule based on the source and destination zones, source and destination networks, services, and schedule. For the destination zone, it uses the zone to which the translated (post-NAT) destination belongs.

Unfortunately, your screen shot is so small I can't quite read it.

I'm still thinking the note (from https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/RulesAndPolicies/NATRules/index.html#load-balancing) might apply:

Incoming traffic: Sophos Firewall looks up the DNAT rule first to determine the translated (post-NAT) destination. It then matches the firewall rule based on the source and destination zones, source and destination networks, services, and schedule. For the destination zone, it uses the zone to which the translated (post-NAT) destination belongs.

Unfortunately, your screen shot is so small I can't quite read it.