From How to do NAT loopback with a dynamic WAN address - #5 by BigG it seems I need a new port forward record to do NAT loopback from LAN to the server?
On my Windows machine where accessing xxxx.ddns.net redirects to the gateway router page (192.168.3.1), doing tracert xxxx.ddns.net returns the external WAN address and not the internal 192.168.3.x address which is correct.