Country Blocking WAF

You do not need a allow NAT. 
Please show the Firewall Rule matching for NAT Rule 2. 

There are multiple waf rules, that are matching. But as I said, my question was in regards to the Userportal.

This is the "countryblock" NAT:

This is an example WAF Rule:

NAT will redirect the traffic, if the NAT rule hits. 

Firewall will allow the traffic.

If NAT hits and firewall rule is not available, it will not forward the traffic (=deny). 

Your firewall rule for the Blackhole NAT does not hit. Therefore you do not see the packet outgoing to the Blackhole Host. 

OR: The blackhole Host is not reachable, therefore the ARP will not be resolved and the packet will not be send.