Steve,
I'm wondering if in Setup > Advanced Routing - you have your device
setup as a Gateway (which uses NAT), BGP, Router (no NAT) or OSLR.
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere
TCPMSS tcp -- anywhere anywhere tcp
flags:SYN,RST/SYN TCPMSS clamp to PMTU
lan2wan 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere state
RELATED,ESTABLISHED
TRIGGER 0 -- anywhere anywhere TRIGGER
type:in match:0 relate:0
trigger_out 0 -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere state NEW
DROP 0 -- anywhere anywhere