Redirect Local Port through bridge to Internet Shared static IP
The proper command to redirect http traffic in your case is:

echo "rdr on $ext inet proto tcp from any to 10.0.0.36 port = 80 -&gt; 192.168.2.34 port 80" | sudo pfctl -a com.apple/HTTP -f -


With $ext: the interface of the iMac connected to the router/modem (probably either en0 or en1). A redirect is done on the incoming interface and traffic! Therefore rdr on bridge100 ... doesn't make any sense here: you don't expect HTTP traffic with the destination 192.168.2.34 from the bridge100 to the network behind the very same bridge100.

The above command uses the temporary sub-anchor com.apple/HTTP and after a reboot it will be gone.

If you want to enable it permanently, create a separate anchor as outlined in this answer: pfctl - howto add an anchor and make it active / load it or here: Port Forwarding on Mac Pro with macOS Sierra.

A pass out route-to ... is only required if you want to redirect outgoing traffic from the iMac.



In theory an additional static route is required on the (TG852G) router/modem:

route to 192.168.2.0/24 via 10.0.0.36


Here (different router though) it worked without it.

Double-NAT solutions are generally not recommended in SOHO environments and I suggest to attach the Debian Linux server directly to one of the Ethernet ports of the router/modem or an interconnected switch.