The service runs, `curl` from the bastion hangs for two minutes

• A new internal service on port 8443 was deployed and its own health check passes locally.
• curl https://10.0.3.14:8443/health from another host hangs and finally fails with "Connection timed out".
• ping 10.0.3.14 from the same host succeeds with a ~0.4 ms RTT.
• Port 22 (SSH) to the same host works instantly.

# on the client
$ curl -v --connect-timeout 5 https://10.0.3.14:8443/health
*   Trying 10.0.3.14:8443...
* Connection timed out after 5001 milliseconds

$ tcpdump -ni eth0 host 10.0.3.14 and port 8443
15:02:11.130 IP 10.0.1.7.51522 > 10.0.3.14.8443: Flags [S], seq 3210441
15:02:12.152 IP 10.0.1.7.51522 > 10.0.3.14.8443: Flags [S], seq 3210441
15:02:14.200 IP 10.0.1.7.51522 > 10.0.3.14.8443: Flags [S], seq 3210441
# SYN retransmitted with backoff; nothing ever comes back

# on the server
$ ss -tlnp | grep 8443
LISTEN 0 4096 0.0.0.0:8443 0.0.0.0:* users:(("svc",pid=2231,fd=6))
$ tcpdump -ni eth0 port 8443
# … silence: the SYN never arrives on the server’s interface