Help with partially working port forwarding

I am struggling to find the source of a failure to port forward.   Most likely a dumb user error, but I just can't see where the issue is.   

I have set up 3 virtual IPs from a WAN interface to a local interface forwarding three different ports, tied them to a VIP group and then put in a policy to enable the routing.    So far so good.

On one of the ports, I can telnet from WAN and get a response from the destination server, but on the other ports, I get nothing back.  From the LAN, I can hit all three ports just fine; so it does not appear to be a problem with the destination server.

When I try to telnet to port 6281 from the WAN I get the following sniffer output  (three retries with no response)

FG100D3G14800997 # diag snif packet lan 'port 6281' 4

interfaces=[lan]

filters=[port 6281]

5.186717 lan -- 192.168.25.130.59321 -> 96.xx.xx.xx.6281: syn 1061727477 

8.188726 lan -- 192.168.25.130.59321 -> 96.xx.xx.xx.6281: syn 1061727477 

14.192043 lan -- 192.168.25.130.59321 -> 96.xx.xx.xx.6281: syn 1061727477 

But doing the telnet to port 22, you can see that it is routing is working.

FG100D3G14800997 # diag snif packet lan 'port 22' 4

interfaces=[lan]

filters=[port 22]

3.549354 lan -- 192.168.25.130.59296 -> 96.xx.xx.xx.22: syn 583024486 

3.549446 lan -- 192.168.25.2.59296 -> 192.168.25.21.22: syn 583024486 

3.549642 lan -- 192.168.25.21.22 -> 192.168.25.2.59296: syn 4254475213 ack 583024487 

3.549705 lan -- 96.xx.xx.xx.22 -> 192.168.25.130.59296: syn 4254475213 ack 583024487 

3.550396 lan -- 192.168.25.130.59296 -> 96.xx.xx.xx.22: ack 4254475214 

The VIP and the policies are all in the same rule....what am I missing here?