Messages

You'll need three separate rules under Firewall: NAT: Port Forward for each individual port.

He could create a port alias with those three ports. Then he needs only two NAT: Port Forward rules, one for each IP. No?

Have you even read the article?

HAProxy is really cool once you figure out how it works.

A backend is just a collection of servers. ACLs (used below) are conditions.

In your case:
- create servers for your two Exchange boxes
- create one backend and put both servers into it
- create an ACL with name "example.com" -> Expression "host ends with" -> Value "example.com"
- create an ACL with name "example.net" -> Expression "host ends with" -> Value "example.net"
- create an action with name "example.com" -> test type "IF" -> ACL "example.com" -> choose action "use server" -> use server "first Exchange"
- create an action with name "example.net" -> test type "IF" -> ACL "example.net" -> choose action "use server" -> use server "second Exchange"
- create a frontend -> Listen address "your WAN address:80" -> actions "example.com", "example.net"

Now install the Let's Encrypt plugin and get certs for example.com and example.net (don't forget autodiscover. etc)
- create a frontend -> Listen address "your WAN address:443" -> SSL offloading enabled -> certificates "example.net", "example.com" -> actions "example.com", "example.net"

That should (broadly) cover it.

Edit: Don't forget to disable NAT for ports 80 and 443 and to add a firewall rule to allow access to 80 and 443.

Grasping at straws now :)
Do the packets from B to A (sorry, had them reversed before) have the correct source address? Or does box B maybe NAT them before sending them to box A?

Looks good so far.

Any chance that ICMP is blocked somewhere, so that box B thinks box A is unreachable or something? Does OPNsense show box A as "up" under System -> Gateways -> Status? (You may have to enable gateway monitoring first)

Can you give us the subnets and netmasks for the networks involved?

I think opening up the documentation so you don't have to do all the work is the way to go.
I would be willing to contribute.

I wondered about that as well when I started using OPNsense. Luckily I had used m0n0wall and pfSense before and the base concepts have stayed the same.

You can always have a look at the pfSense documentation
https://doc.pfsense.org/index.php/Category:Firewall_Rules
https://doc.pfsense.org/index.php/Category:NAT
as a starting point.

But I agree, OPNsense needs their own documentation on what is after all the core functionality of the product.