Whenever something seems strange, always check the Intrusion Prevention, Application Control and Firewall logs.
Rule #2:
In general, a packet arriving at an interface is handled only by one of the following, in order: DNATs first, then VPNs and Proxies and, finally, manual Routes and manual Firewall rules, which are considered only if the automatic Routes and rules coming before hadn't already handled the traffic. (see attachment below)
Check those 2 points first! There should be a block in Firewall logs or somwhere else!
