This is covered with:
I don't own a MT3000. And I am not at home to build a lab to test with similar devices. But your issue is the forwarding, not the firewall. So this whole topic is the wrong thread.
With the given keywords and a little forum search, I would trust Static route on Marble GL-B3000 (Beta Tester) - #2 by dxf and try in Lucy to set the 'Firewall (how ironic) - Zone Settings' on Name 'wan' at option 'Forward' to 'accept' ... And following hints in this post.
I am at home on Monday, but don't expect to have time for another lab to test the OpenWrt settings myself.