Firewall rule change looks correct but connection tracking keeps old assumptions alive

A rule update should allow new traffic, but live sessions still fail because connection tracking or stateful inspection has not re-evaluated the path the way operators expect.