Running server (Nextcloud) with external access *not* via default gateway

[TheSHAD0W]

Background: I have two satellite uplinks, one with unlimited bandwidth but behind a NAT, and one with a public IP but metered bandwidth. The first is set as my default gateway, while the second will be limited for external service.

I've been trying to route traffic for my Nextcloud server through the second gateway, and have created firewall rules to do so. tcpdump shows connection replies from activity on the second gateway being sent out the first one despite all attempts I've made to direct the traffic correctly. Connections initiated from the server going outside are being routed through the correct (second) gateway.

Here are my routing table status and the firewall rules I've created... https://imgur.com/a/az73LDb

Here is the output of pfctl -sr ... https://pastebin.com/gunnwfX3

Edit: The screenshots don't show that the bottom two rules have the gateway set as WANsat2

[viragomann]

tcpdump shows connection replies from activity on the second gateway being sent out the first one despite all attempts I've made to direct the traffic correctly.

The "reply-to" tagging is responsible to route replies back to the correct gateway.
This presumes that
- you have the proper gateway stated in WAN interface settings in case manual IP configuration
- and that the firewall rule, which is passing the incoming traffic to the web server, is defined on the incoming interface (no group or floating pass rule must match the traffic).

Note that interface group or floating rules have precedence over interface rules.

[TheSHAD0W]

- Setting "reply-to" tagging to the appropriate gateway did not help.

- Interface configuration for that gateway is DHCP, not sure what you mean. That interface is set as a gateway and is operating; if I change its priority to highest in gateway configuration it operates as expected.

- Firewall rule is defined on correct interface (and is where I changed the "reply-to tagging setting).

I have no floating rules defined and there are no pass rules that appear to have precedence... With the exception of one autogenerated rule that appears to be getting involved in the exchange, "let out anything from firewall host itself". Could this be getting in the way?