OPNsense blocks packets incoming to WAN from networks not attached to WAN

[zemanek]

Hello,

I have OPNsense with only one NIC and IPsec tunnel. If I port-forward from IPsec tunnel to some machine on the same network as the OPNsense is, it works. But when I port-forward to some other network not directly attached to WAN interface, I can see in packet capture in promiscuous mode that the reply (SYN, ACK) packet arrived to OPNsense but was not processed. The "Default allow LAN to any rule" is active.

WHY? And how to fix it?