[SOLVED]I've beat my head against the wall: How do I do NO-NAT but HAVE FW rules

[lrosenman]

I will try this later this week when I head over to the Colo when I can keep access local.  I've set that option.

[5SpeedFun]

Not direclty as a suggestion to your problem, but I believe opnsense has a serial access option.  If your colo offers OOB serial port access this may make it easier for you to troubleshoot without the possibility of losing connectivity:

https://docs.opnsense.org/manual/how-tos/serial_access.html

[lrosenman]

unfortunately, the colo doesn't provide OOB serial, but thanks for the suggestion.

[lrosenman]

apparently what I needed was to turn off the REPLY-TO on the WAN -- works a treat now.

Thanks, ALL!