Can ping and resolve DNS but cannot access websites (potentially double-NAT)

[inslee]

I have an out-of-the-box OPNsense installation (24.7.3_1) virtualized in Proxmox and sitting behind an ISP router with its own NAT.

My OPNsense WAN IP range is in the 10.0.0.0 range (which is what it gets from the ISP router)
My OPNsense LAN IP range is in the 172.16.0.0 range (which is what I've set in my DHCP range)

What I've observed:

• I can ping and resolve DNS from LAN machines connected to the OPNsense host but cannot access webpages through a browser or through curl
• I am able to access the internet from the OPNsense host VM
• The firewall logs show a pass for the requests I'm making from the LAN to the WAN
• MTR from the VM on the LAN interface shows icmp making it out to the internet but 100% loss at the hop between OPNsense WAN and the LAN interface of my ISP router

Since the OPNsense host is able to connect to the internet but the VMs behind the OPNsense LAN are unable to, my suspicion is that the issue lies within OPNsense. Any suggestions as to what I should check?