Internal routing with two firewalls

I have no experience with Sophos at all, but it's a general problem with stateful firewalls that seems to be familiar. The issue is that your FW2 has an interface in the same subnet as System A, which results in asymmetric, triangular routing:

• Packets from A to B take the path:

  A > (default route) > FW1 > (static route) > FW2 > (subnet route) > B
  

• Packets from B to A instead take the path:

  B > (default route) > FW2 > (subnet route) > A
  

  (You probably have cut out the 192.168.150.0/24 subnet route from the FW2 table dump, but I'm sure it has such a route – due to its own IP address being 192.168.150.54.)

In other words, the firewall FW1 is bypassed for B > A and only sees one "half" of the connection. This wouldn't be an issue if FW1 was merely a gateway (router) as it'd forward the A > B packets normally, but it's not just a gateway, it's also a firewall.

Asymmetric routing means:

1. For TCP connections initiated A > B, FW1 will see the initial TCP SYN and will create a firewall state for further A>B packets, so the connection will appear to work fine (but due to the firewall seeing no reply packets, the state might expire sooner than you expect and the connection might freeze – I know that happens with pfSense firewalls).

2. However, for TCP connections initiated B > A, the TCP SYN will go directly via Ethernet from FW2 to A, not seen by FW1 at all – the only thing seen by FW1 is the "established" TCP ACK packets (including SYN/ACK and data), which do not match any connection tracking state.

   How these are handled depends on the firewall: some implementations – e.g. Linux iptables/conntrack – have a "loose TCP tracking" mode to implicitly create states, but other firewall implementations instead drop them as unknown packets.

When you add a static route on A towards B, the situation becomes that FW1 is bypassed in both directions, so its firewall policy no longer interferes.

What I'd recommend is the opposite – to move FW2 out of the "main LAN" subnet. Instead of having FW2 in the 150 subnet, you should dedicate either a new VLAN or the whole Ethernet port for the FW1—FW2 connection, configuring an IPv4 /30 between them (or a /31 if they both support it). That way, traffic from FW2 will have no choice but to go through FW1 in both directions, which will be able to correctly track the connection states.

(If you can't spare a VLAN, then using a dedicated /30 on the same VLAN may also work, but only as long as FW2 does not accept any "shortcut" ICMP Redirects that FW1 is likely to offer; accepting a redirect would effectively return to the current state. It also makes the topology even more confusing.)

Partial workaround (only for TCP): Add a firewall rule to FW1 that permits all TCP packets with the ACK flag set. (The flag is always present in "established" packets but never in the first SYN handshake packet, so it'd allow the return path.)