Synology Diskstation UI and Docker Container UIs crawl outside LAN

I'm seeing an issue with my OpenWrt setup.
I've got one router (R7800) running Openwrt 19.07.3 and I've got the necessary firewall rules to forward certain ports to relevant internal IPs. When I'm within my LAN, my laptop/devices can access the Synology Diskstation NAS UI and everything is really responsive. The NAS will be busy doing several things (grabbing torrents, serving movies/shows via plex and yet the memory consumption always stays around 50% or so).

As I try to access the UIs for various docker containers running on my DiskStation outside of my LAN, everything crawls. I can't ever get Sonarr UI to load. Radar UI comes up every now and then. The Diskstation UI takes forever to load. If am lucky enough to be able to login, I will face a huge uphill battle with the speed at which the UI is rendered. I can verify that everything is snappy within the LAN.
On my Synology I am running: Plex media server, Docker containers for Radarr/Sonarr/Jackett/Transmission
The router and diskstation are connected by a 1gb unmanaged netgear switch (there are no loops).
Can someone advise on where I should start looking ?

EDIT: Just experienced something strange. I was remotely connected to my diskstation via SSH (from outside my lan). I ran top -d1 and my ssh session hung.

What speed (both up and down) does your ISP provide? You might find that your Internet connection is saturated due to the activities of the NAS; that might be what's causing the slow performance when connecting from outside.

I've got a gigabit fiber line. The NAS will at most do somewhere close to 6-7MBytes/sec when its the most active. And still very response from within the LAN. I can watch a movie served by Plex Media Server on without any hiccups.
While the NAS is busy, doing a speedtest with my wired PC shows anywhere from 800-900mbps speeds (up & down).
This is clearly a WAN<>LAN issue.


Something is wrong with the firewall module on my R7800 running 19.07.3 stable.
I've now tried configuring the same exact firewall rules on a TP-Link Archer A7 running 19.07.3 and there are zero issues.
Both have Software Flow Offloading enabled.
TP-Link running ath-10k-ct drivers
R7800 running non-CT ath-10k drivers (-ct drivers had a bug preventing LG OLD65C8P TV from connecting to the 5GHz band)
Once I'm back at home (where my r7800 happens to be installed), I'll test with the NAS re-attached to see if the issue is gone or not. Otherwise I will have no choice but to the upgrade to the latest stable 19.07 build (or I'll build my own verison of the stable release with my needed software pre-installed).