OPNsense: port-forward unreachable from the same WAN subnet (reply-to)
OPNsense adds reply-to to WAN rules and sends replies to the gateway even when the client is on the same segment. Disable it and the firewall goes back to its routing table.
Pf
pfctl: table cheat sheet for pfSense, OPNsense and FreeBSD
pfctl -sT lists tables; pfctl -t -T show|add|delete|test|flush|replace -f. On pfSense aliases are tables, sshguard is the failed-login lockout, and manual changes vanish on the next rules reload.