We have several Windows virtual servers, with various forms of external traffic being routed from external IPs to their internal network addresses.
The 'problem' rule on the took all HTTP and HTTPs traffic from the (Kerio) firewall and passed it to the reverse proxy table to sort out which server it should be sent to. The fix was to specifically
take all the HTTP and HTTPs traffic destined for the Web server's external IP and pass it specifically and directly
to the internal IP of the server, and give this rule preference to the original. In theory, the new rule doesn't do anything materially different to the first one, but obviously does do something different.
With the 'bypass' working, at this point I'm somewhat disinclined to investigate further!