I was thinking about that, too. I can't explain it why I could see the management interface before from a public IP despite this apparent interception of packets.
I frequently disconnect my phone from WiFi and use it to test how my IP appears from the open internet. I'm fairly confident that I didn't forget to turn off WiFi when I noticed that the admin interface was available via WAN. Also, other threads on this forum corroborate that the management interface binds on all Interfaces. Seems like a security problem to me, but no one other than the OPs seems to care in those other threads.
Rather than fighting pfsense, the easier path is to just move the management ports (as our testy friend suggested) and keep them blocked rather than doing something risky and more complex like trying to keep the standard ports but not binding on certain interfaces.
Getting back to the mystery of how some packets are intercepted before hitting my firewall and some aren't. I wouldn't put it past a cable provider or cable modem manufacturer to be interfering with my connection, maybe even in intermittent ways. I will know more after I set my reverse proxy back up after tearing it down thinking it was somehow interfering with critical aspects of the firewall.
