need policy based routing for the return path (ACK)

[thorstenrood]

I use a 1-arm proxy in a DMZ network (separate interface/vlan) that has to forward packets based on the original client IP address, so the return path (ACK) arrives opnsense but obviously it is attempted to route this "straight" to the internet and not back to the proxy, ending up in an incomplete state and retransmissions from the proxy.

I tried adding a new rule on the inside interface with matching source port / source IP criteria and custom gateway (PBR/MultiWAN-style) but the rule cannot handle the ACK portion.

Can opnsense run policy based routing based on the inbound rule only and _not_ on return paths? How to solve this differently, other than making the proxy a real routing hop in between the internet and the opnsense or in between opnsense and the target server(s)?

Thank you!

Thorsten