XVO, much appreciate you reply.
I will go with the "worse" option.
Please excuse my ignorance, could you advise how I could do that?
I cannot see the option to forward the port on the hEX router.
Port 5 on the hEX is connected to Port 1 of the switch.
1) A dst-nat rule in your IP --> Firewall --> NAT that will forward requests from WAN on some port (chose it yourself) to 80 port on the local address of your switch.
2) A rule in forward chain of your IP --> Firewall --> Filter that will allow these dst-nat'ed connections (connection-state=new connection-nat-state=dstnat) - if you use default firewall rule, you probably already have one, but you need to check it.