iRule : snatpool first or pool member selection first

OK, understood. Yes I did, the point I'm trying to make is, if you use an SNAT IP address that is routed back to the correct F5 interface it doesn't really matter what it is. So, you can either change the routing as necessary to ensure traffic returns to the correct interface, modify your iRule and use an SNAT pool that will be routed back correctly or not use 3.3.3.254.

 

 

The behavior you are seeing is correct and expected. You need to decide on and implement a configuration that will work. I'm happy to help here.