I have my NAS connected via ethernet to an XE75 satellite.

I have implemented nine port-forwarding rules from the main XE75 to my NAS, most of which work (e.g. SMTP, HTTPS). All port-forwarding rules were applied to the XE75 at the same time.

However, three ports (3012, 5510, 51820) indicate that they are closed when I run an external port scan. My NAS firewall is configured to be open to these ports, and I have tested with the NAS firewall disabled.

The latter port is my Wireguard server. I can confirm that when I connect to Wireguard whilst on my LAN, the handshake with the Wireguard server works successfully. When I connect to Wireguard externally (e.g. from mobile/cellular), the handshake fails.