OPNsense: port-forward unreachable from the same WAN subnet (reply-to)
OPNsense adds reply-to to WAN rules and sends replies to the gateway even when the client is on the same segment. Disable it and the firewall goes back to its routing table.
Nat
pfSense and OPNsense: the port forward does not work from the LAN itself (NAT reflection and split DNS)
LAN → public IP traffic never leaves through the WAN, it dies at the firewall. Split DNS (host override → internal IP) is the clean way; Pure NAT + automatic outbound NAT for reflection when the DNS is not yours.