wan interface
there is no such thing as traffic going to a LAN address
an undocumented shortcoming, the firewall cannot understand traffic going to an internal address. Instead the traffic goes to the public WAN IP
you can't apply firewall rules on the WAN: they don't work