Just out of interest, are you willing to check/test it with Rocky 8? If not I’ll fire up a Rocky 9 install to make a firewall from it to try and replicate your issue. We could at least rule out if something in Rocky 9 changed that is stopping this from working.