It's pretty weird.

The same firewall rules work when I deconfigure the second external interface. So I think the firewall is okay.

tcpdump shows the packets arriving at the gateway on the LAN interface, but they appear to die there, even before the Linux iptables firewall gets to see them (it NEVER sees them).

So, a routing problem.

Cheers