Hi
As noted by the others, it is your sonic firewall that is not correctly configured.
When pc sends traceroute to 4.2.2.2, it sends 3 packets with ttl=1, that means the swithch have to drop the packets and sends a icmp ttl expired back to the pc. The pc then sends 3 packets with ttl=2. The switch looks in the routingtable and forwards the packet towards the sonic firewall, it also decrement the ttl value from 2 to 1. The packets arrive to the sonic that realize that the ttl is to expire, so it will look in its routingtable to see where 192.168.100.0 net is, so it can send the icmp ttl expire.
It probably finds that there is no such routingentry and will therefore send the packet too its default, wich is upstream to the provider.
The same scenario if you ping 4.2.2.2 from pc. It sends packet to switch, the switch sends to sonic, sonic sends to provider, when answer comes back there is no routingentry for 192.168.100.0.
The above is for routing part.
On top of that you also need to have nat configured for 192.168.100.0.
/Mikael
