I previously configured Hairpin NAT before it was time to deploy the VyOS router and tested it behind a temporary double NAT (configured an interface on my EdgeRouter to provide 10.0.0.0/8 addresses that I let the VyOS router NAT to 192.168.1.0/24).
This configuration appeared to be working fine after making the suggested changes. However, now that I’ve replaced the EdgeRouter with my VyOS router I no longer have working Hairpin NAT. 
What am I missing? Any help would be greatly appreciated. 
Sanitized configuration:
firewall {
flowtable FT-OFFLOAD {
interface "eth2"
interface "eth1"
}
group {
domain-group WAN-IP-DOMAIN {
address "mydomain.com"
}
interface-group LAN {
interface "eth4"
interface "eth1"
}
interface-group MANAGEMENT {
include "LAN"
interface "eth8"
}
interface-group WAN {
interface "eth2"
}
network-group NET-LAN-v4 {
network "192.168.10.0/24"
network "192.168.1.0/24"
}
}
ipv4 {
forward {
filter {
rule 5 {
action "offload"
offload-target "FT-OFFLOAD"
state "established"
state "related"
}
rule 10 {
action "jump"
jump-target "CONN_FILTER"
}
rule 100 {
action "jump"
destination {
group {
network-group "NET-LAN-v4"
}
}
inbound-interface {
group "WAN"
}
jump-target "OUTSIDE-IN"
}
}
}
input {
filter {
default-action "drop"
rule 10 {
action "jump"
jump-target "CONN_FILTER"
}
rule 20 {
action "jump"
destination {
port "22"
}
jump-target "VyOS_MANAGEMENT"
protocol "tcp"
}
rule 30 {
action "accept"
icmp {
type-name "echo-request"
}
protocol "icmp"
state "new"
}
rule 40 {
action "accept"
destination {
port "53"
}
protocol "tcp_udp"
source {
group {
network-group "NET-LAN-v4"
}
}
}
rule 50 {
action "accept"
source {
address "127.0.0.0/8"
}
}
}
}
name CONN_FILTER {
default-action "return"
rule 10 {
action "accept"
description "Allow established/related"
state "established"
state "related"
}
rule 20 {
action "drop"
description "Drop invalid packets"
state "invalid"
}
}
name OUTSIDE-IN {
default-action "drop"
rule 8 {
action "accept"
description "HTTPS Server"
destination {
address "192.168.1.10"
port "443"
}
protocol "tcp_udp"
state "new"
}
rule 10 {
action "accept"
description "SSH"
destination {
address "192.168.1.10"
port "22"
}
protocol "tcp"
state "new"
}
}
name VyOS_MANAGEMENT {
default-action "return"
rule 15 {
action "accept"
inbound-interface {
group "MANAGEMENT"
}
}
rule 20 {
action "drop"
inbound-interface {
group "WAN"
}
state "new"
}
}
}
}
nat {
destination {
rule 8 {
description "HTTPS Server"
destination {
port "443"
}
inbound-interface {
group "WAN"
}
protocol "tcp_udp"
translation {
address "192.168.1.10"
}
}
rule 10 {
description "SSH"
destination {
port "22"
}
inbound-interface {
group "WAN"
}
protocol "tcp"
translation {
address "192.168.1.10"
}
}
rule 108 {
description "NAT Reflection: HTTPS Server"
destination {
group {
domain-group "WAN-IP-DOMAIN"
}
port "443"
}
inbound-interface {
group "LAN"
}
protocol "tcp_udp"
translation {
address "192.168.1.10"
}
}
rule 110 {
description "NAT Reflection: SSH"
destination {
group {
domain-group "WAN-IP-DOMAIN"
}
port "22"
}
inbound-interface {
group "LAN"
}
protocol "tcp"
translation {
address "192.168.1.10"
}
}
}
source {
rule 100 {
description "NAT"
outbound-interface {
group "WAN"
}
source {
address "192.168.0.0/16"
}
translation {
address "masquerade"
}
}
rule 110 {
description "NAT Reflection: INSIDE"
destination {
address "192.168.1.0/24"
}
outbound-interface {
group "WAN"
}
protocol "tcp_udp"
source {
address "192.168.1.0/24"
}
translation {
address "masquerade"
}
}
}
}
