OPNsense: port-forward unreachable from the same WAN subnet (reply-to)
OPNsense adds reply-to to WAN rules and sends replies to the gateway even when the client is on the same segment. Disable it and the firewall goes back to its routing table.
Opnsense
pfctl: table cheat sheet for pfSense, OPNsense and FreeBSD
pfctl -sT lists tables; pfctl -t -T show|add|delete|test|flush|replace -f. On pfSense aliases are tables, sshguard is the failed-login lockout, and manual changes vanish on the next rules reload.
pfSense and OPNsense: the port forward does not work from the LAN itself (NAT reflection and split DNS)
LAN → public IP traffic never leaves through the WAN, it dies at the firewall. Split DNS (host override → internal IP) is the clean way; Pure NAT + automatic outbound NAT for reflection when the DNS is not yours.
Virtualized pfSense with VirtIO: no traffic until hardware checksum offload is disabled
With vtnet, FreeBSD drops packets whose checksum was never computed. Tick Disable hardware checksum offload and reboot the VM even though the GUI does not ask; until then no traffic flows.