Exempt some traffic from NAT

[hase]

opnsense noob here (with some netwroking background).

simple setup:



            +----------+                 +------------+
--- LAN --- | opnsense | --- DSL net --- | dsl-router |
            +----------+                 +------------+
              |
             |                      +-------------+
             +------- cable net --- | cable router|
                                    +-------------+


I also have Multi-WAN set up with a fail-over GW-group CABLE-DSL, seems to work so far.

I was puzzled by the fact that I could not reach any device on the DSL network from within the LAN network.
The reason is simple: the NAT gets applied to the SYN-packets originating in LAN and then the packet is fed to the firewall. The firewall rules and routing then trat the packet as a packet originating on the firewall itself - so the gateway is forced to the GW-group and sent to the cable router.
the cable router then bounces the packet right back (detination is in an internal network, the opnsense is set as the gw for all internal networks on the cale box).

The incoming packet on the WAN is the blocked by a fw rule.

So far, I understand the problem.
Packet is natted, then firewalled then routed, ends up at the cable box.

What I want to achive is:

- traffic LAN -> BEI going through NAT
- traffic LAN -> DSL-net no NATted

I tried switching NAT-outbound to "Hybrid" and adding a NO NAT rule for source "LAN net" destination "DSL net".

Result: same as without the rule. packet originating on LAN still natted to the opnsense IP address in sourceIP and then forwarded to the cable router, even with the destination address clearly in the DSL net range.