When I was a Sophos UTM beginner most of my troubleshooting problems were related with not knowing the fact that DNAT is before proxy, and Firewall rules for HTTP/S traffic and Applicaton control module after it.
Technically speaking, if you select 'Automatic firewall rules' in a DNAT, WebAdmin and the configuration daemon create a firewall rule which is placed ahead of the manually-created rules. If you don't make the automatic selection, a manual firewall rule must be made.
