can't reach webserver running on different port

I have 2 webservers (with their own internal IP) behind 1 public IP.
The first one is IIS for OWA, the 2nd one is an Apache webserver where people login to for an internal application. I have it listening on port 800.
I made a html redirect from http://webserver2.company.com to http://webserver2.company.com:800 so they don't have to know the port.
I have a hosts entry for webserver2.company.com that points to the internal IP
I can reach http://webserver2.company.com:800 just fine internally, but not from the outside.

Here's how I set up Astaro V7:
- networks: webserver2 192.168.100.18
- services: HTTP 800 TCP 1:65535 → 800
- packet filter: Any webserver2 HTTP 800 ALLOW
- DNAT: Any → HTTP 800 → Extern (Address)
Destination translation: webserver2


Problem is that I can't reach the webserver from the outside.
I need this up and running on monday, so I'd very much appreciate any help with this.