Forefront TMG denied connection using HTTPS listener

I have configured a web publishing rule to allow access to an internal server over HTTP.  When i publish the rule everything works as expected. When I change the rule to use a HTTPS listener, the rule seems to be ignored and I am getting the default rule applied. This results in:

Denied connection

Log type: firewall service

Status: The policy rules do not allow the user request

Rule: default rule

Source: External

Destination: Local Host (192.168.0.10:443) Protocol: HTTPS

Everything looks right on the listener. I even have another TMG setup with same rules and it works fine though on a single NIC.
This setup is a windows server 2008 R2 vm on a dual-homed hyper-v server (and it's a UAG install if that makes a difference).

Any thoughts?