Troubleshooting port forwarding to DMZ

[mcon]

I am having problems making my redirect working.

First of all I have a slightly unusual setup (comments welcome) as I have two asymmetric ISP connections, both with standard NATting modem/routers:

• #1 (192.168.1.1) is fast fiber but it has "floating" external IP.
  
• #2 (192.168.1.2) is slower DSL but has a fixed and routable external IP.
  

I installed OPNsense with standard three interfaces:

• LAN (192.168.7.9)
  
• WAN (192.168.1.9)
  
• DMZ (192.168.9.9)
  

I (currently) have a single "webserver" on DMZ ( 192.168.9.8 ) carrying `nginx`.
Setup is to use #1 for normal operation and #2 as fallback (using Monitoring).
This seems to work from both LAN and DMZ; also DNS caching seems to work as expected.
#2 has full port redirection to OPNsense.
I further redirected ports 80, 81 and 443 from OPNSense to "webserver" and added  Unbound DNS: Overrides to shortcut LAN to "webserver".
I can access "webserver" from LAN, but not from Internet.
If I try to access it from outside I see redirection taking place and also packet going to DMZ, but nothing else:

Code: [Select]

DMZ 2023-12-20T15:16:48 109.52.98.12:58623 192.168.9.8:443 tcp let out anything from firewall host itself
wan 2023-12-20T15:16:48 109.52.98.12:58623 192.168.1.9:443 tcp rdr rule
DMZ 2023-12-20T15:16:48 109.52.98.12:58641 192.168.9.8:443 tcp let out anything from firewall host itself
wan 2023-12-20T15:16:48 109.52.98.12:58641 192.168.1.9:443 tcp rdr rule

I am at a loss on how to troubleshoot this.
I have no problems in sharing my current settings, if useful (on second thought I just attach it here ).
Any hint would be greatly appreciated.

Note: I am a newbie to OPNsense and not really a net-guru so I might well have overlooked even the obvious.

Many Thanks in Advance
Mauro