[jggimi]

The final test rule has "on $proxy" but I've noticed that $proxy is defined as an IP address. However, "on" is used for interfaces or interface groups, not IP addresses.

This last rule will never match any packets.