I'm suspecting that opnsense autogenerated rules cause my routing to fail (https://forum.opnsense.org/index.php?topic=45558.0). It should be possible for the user to opt-out of these rules.
UPDATE: issue turned out to be unrelated to firewall rules, nonetheless if I could have easily turn them off I would have quickly recognized that they are irrelevant to the issue instead of wasting a day fiddling with firewall rules (especially when you are new to opnonsense)