PPPoE, ping and DNS but no browsing

I feel really lost here. I’ve deployed an RB5009 using a PPPoE connection (two in fact) and have an odd issue that clients can poing WAN IPs, resolve DNS , but cannot browse the web. We just get err_connection_timed_out.

My gut feel was this looked like an MTU issue, but changing the MTU settings has not helped. I’ve added a masq rule for PPPoE2 as that is the only one connected at the moment, this router is running on a spare IP in testing until I can go fully live.

Sanitized config attached.
5009config.rsc (11 KB)

I’m an idiot, I had misconfigured firewall/NAT rules for an internal service that was grabbing all the 80/443 traffic.