@cccthats3cs
Hello!
For the readers too.
The problem was most probably caused by a rare conflict caused by a vicious bug which has been resolved. Haedus runs on a kernel based exclusively on nftables, but with iptables-nft userspace utility still available when the system basic files are uploaded in RAM.
An old script of ours invoked iptables-nft once during the bootstrap and triggered the feared "translations" back an forth between iptables and nftables, which in turn caused rare troubles in adding and removing rules for remote inbound port forwarding. This series of unfortunate events was resolved by fixing the script (no more iptables-nft, of course). Fix deployment has been ongoing on the infrastructure since a week ago but was not yet rolled out on Haedus. The fix is deployed gradually because in general the bug does not cause these issues and also because a complete clients disconnection is required to bring back the system to a "no nft/iptables hybrid" status.
Thank you!
Kind regards