Hi,
That was standard VS, so should have Address and Port translation checked. I have no access to the system right now to check as it was on some test system set at customer site. Anyway nothing except mentioned setting was modified from defaults when vs was created.
Still what could be reason of denying page, customer claimed that there are no blocking measures set for the server - and it seems so as both curl and browser can access server when pointed directly.
Anyway, thanks for help, when I will have chance to do dumps maybe something will clear up.
Piotr