Same topology, but: external access ALSO works sometimes fro...

Prompt

Same topology, but: external access ALSO works sometimes from internal (1 in 5 attempts), and conntrack shows both DNAT and SNAT hits. Diagnose with the ambiguity resolved by evidence ordering.