My problem is that then I go to Services > apache_mod_security - Start service I get announcement
"apache_mod_security has been started." But icon is left as "no running".

Do I need to remove port 80 forward from PFsense to my web server "X" and enter each website hostnames as redirections by headers in mod_security to get it up and running? I thought  that if I have port redirection and mod_security each my request will be redirected by filtering by mod_security. If a website name is not in mod_security table it will be redirected "X" web server. And only if request goes to extra.domain.com it will redirect to server "Y" Am I right?

Thanks.