(Internet) | |[proxmox-ve-host] (public ip) | |[opnsense-virtualmachine] (WAN-IP: 10.10.0.1)
proxmox # iptables -t nat -L -v n...Chain PREROUTING (policy ACCEPT 17955 packets, 1182K bytes) pkts bytes target prot opt in out source destination 6931 309K DNAT 6 -- enp0s31f6 * 0.0.0.0/0 0.0.0.0/0 multiport dports !22,8006 to:10.10.0.1...Chain POSTROUTING (policy ACCEPT 50314 packets, 3312K bytes) pkts bytes target prot opt in out source destination 4896 369K MASQUERADE 0 -- * enp0s31f6 10.10.0.0/31 0.0.0.0/0
15,,,02f4bab031b57d1e30553ce08e0ec131,vtnet0,match,block,in,4,0x0,,53,5567,0,DF,6,tcp,60,151.189.142.234,10.10.0.1,54880,444,0,S,861491563,,64240,,mss;sackOK;TS;nop;wscale
pfctl -vvsr | grep '@15' -A1@15 block drop in log inet all label "abcedf21424..." [ Evaluations: 85 Packets 91 Bytes 4312 ]
# pfctl -vvsr >myrules# grep 444 myrules(no output)
could it be possible you forgot to click on "Apply" after adding the rule? I've seen it happen.
OK. I'm not as familiar on pf as iptables so can't tell how to find your rules but if you want to focus on "fixing" it, please post your rules on the relevant interface.
Remember if your OPN WAN is a private address, you need to disable the default block "Block private networks" (can't tell if your masquerading to a private one).
[public-ip:444] --> [10.10.0.1:444]