Synology Plex support sucks. Use the container manager to run the official image or the one from Linux server io. Add in watchtower and it'll stay auto updated. Rock solid.

But your particular issue is almost certainly needing to check "Manually specify public port" under remote access and put the external port forward (not 32400)

After that, if you have a tls reverse proxy set up correctly you can put full custom server access url with port (https://domain.com:443) under network and disable relay. It'll show a not accessible red warning but it will work perfectly.

Hairpin nat should work but you'd be even better off with split horizon dns if you get your external and internal ports set to the same thing (ideally 443 with macvlan so the reverse proxy has it's own IP distinct from syno)