Will have a ponder on that one - definitely feels like it could be easier to troubleshoot than hairpin NAT rules. I’d have a look at how I can script it, to automate pulling from my external DNS (two domains, but a handful of subdomains that I use for experimentation - and I’d rather only set it up in the one place.
In regards to the speed issues - I raised a ticket - the issue was with “VLAN Filtering”. As soon as I disabled this on the bridge, the traffic went via the fast track, and performance went up, and CPU usage dropped. According to the support person, it’s something they’ll support in the future, just no ETA. Have struggled to find anything explicitly mentioning that in the docs - but I suspect that comes down to me, rather than it not being in the docs.
Thanks for your help, and hopefully this will help someone who has a similar issue in the future.