Port forwarding through Direct Connect

This sounds like a routing problem on the return path. Check the route tables for each step for the traffic back to the source of the TCP session:

• Subnet route table (should forward to the transit gateway)
• Transit gateway route table associated to the VPC attachment (should forward to direct connect)

Based on the information provided, it seems you're experiencing an issue with return traffic not making it back through your Direct Connect connection. Here are a few potential areas to investigate:

1. Routing Configuration: Ensure that your on-premises router and AWS Direct Connect router are properly configured to route traffic in both directions. Check that the correct routes are being advertised over BGP for both your VPC CIDR and your on-premises network.

2. Transit Gateway Route Tables: If you're using Transit Gateways, verify that the route tables are correctly configured to allow traffic flow in both directions between your VPC and the Direct Connect gateway.

3. Firewall Rules: While you mentioned creating security groups and allowing all traffic in Network ACLs, double-check your on-premises firewall rules. Ensure that they allow both inbound and outbound traffic for the ports you're trying to forward.

4. Direct Connect Gateway Configuration: Verify that your Direct Connect gateway is properly associated with your Transit Gateway and that the allowed prefixes include your VPC CIDR range.

5. VPC Route Tables: Check that your VPC route tables have the correct routes to send traffic back to your on-premises network via the Transit Gateway.

6. BGP Configuration: Ensure that your BGP session is properly established and that you're advertising the correct routes for your on-premises network over the Direct Connect connection.

7. MTU Settings: Verify that the Maximum Transmission Unit (MTU) settings are consistent across your network path, including your EC2 instance, VPC, Direct Connect, and on-premises network.

Given that internal traffic flows fine, the issue is likely related to the specific port forwarding configuration or how return traffic is being routed. It might be helpful to engage with your network team or AWS support to perform a more detailed analysis of the traffic flow and routing configuration.

Sources
Use on-premises firewall with DC transit VIF to route VPC traffic | AWS re:Post
Troubleshooting AWS Direct Connect - AWS Direct Connect
Troubleshoot VPN routing issues | AWS re:Post