Steps to reproduce:

1. Zabbix server is on subnet A (IP 10.23.0.64)
2. Agent is on subnet B (10.23.1.128/27)
3. Firewall allows communication between both subnets (no NAT)
4. Agent allows passive checks from IP 10.23.0.64

Result:
No passive communication possible. Logfile shows: failed to accept an incoming connection: connection from "10.23.1.129" rejected, allowed hosts: "10.23.0.64"

Expected:
The agent should see incoming connections from 10.23.0.64 and not from 10.23.1.129 (this is the gateway IP address). TCPView (Sysinternals) shows correct IP address if I do a telnet from Subnet A to the agent machine.

Workaround:
Add gateway IP address to allowed server IPs. This is a bit cumbersome as we have many subnets to monitor and have one installation package to deploy. We manually need to add the specific gateway IP.