NATed traffic without payload

[michaelgo]

VM subnet A => opnsense NAT rules to webapp port 80 or 443 => VM subnet B
I can see the rules work (rdr and pass) but tcpdump on VM B shows no payload (length 0)
What can possibly cause this behavior?
both hosts are reachable from opnsense, tcpdump on opnsense interface A also shows length 0
(the web app on VM B works when opening directly from the subnet B)
web gui http redirect is off
bogon and private for interface A and B are off
this is a Virtualbox setup