After a firewall NAT change, internal users can reach the internet, but public users cannot reach the school showcase app. A packet capture shows inbound requests arriving at the firewall's public IP but no translated packets leaving toward the app server. Which next step best isolates the problem?