Tried to add that Dynamic prefix forwarding - didn't help.
After I enabled a setting Network->Interfaces->LAN->DHCP server->IPv6:
Always announce default router
and then renewing DHCP6 on the client, I can now see that ICMP6 packets are going to the target 2008:a:a:a::2, but no response are being sent. Because the source address is from LAN: fd51:3551..., not WAN6 2008:a:a:a::1. Doesn't look like masquerade is enabled. Where is that setting to enable masquerade?