pfSense and OPNsense: the port forward does not work from the LAN itself (NAT reflection and split DNS)
LAN → public IP traffic never leaves through the WAN, it dies at the firewall. Split DNS (host override → internal IP) is the clean way; Pure NAT + automatic outbound NAT for reflection when the DNS is not yours.