Complicated setup with iptables

Greetings,

I’m running two Proxmox servers, one as production and one as backup server. Both have multiple virtual NICs, called VMBR#s.

On backup server, there are only few iptables rules, just to reroute internet to correct virtual linux bridge (virtual NIC) and add some port openings. I do not block anything with iptables on this server.

Backup server has VMBR4 IP set to 192.168.6.2 and it can ping VMBR4 on production server that has IP 192.168.6.1 and vice verse.

Production server has a bit more complicated iptables rules.

I followed this guide: https://dannyda.com/2020/05/28/how-to-backup-proxmox-ve-host/ and got stuck once it comes to connectivity, server does not automatically discover client.

I have opened ports 35621-35623 on clients side (production PVE) and port 35623 on server side (backup PVE), with similar iptables rules:

iptables -A INPUT -p tcp --dport 35623 -j ACCEPT

I can access WebGUI via port 55415 and if I add client as a hint, it pings it, shows client on ip 192.168.6.1 online but then after 5 minutes, shows it as offline.

I know its hard to help me with this info, but its really complicated setup. What else can I supply to easen up debuging a bit? I know its not UrBackup software problem, its completely on my network config side…

Maybe the question is, how to bind UrBackup server to listen and use only one specific NIC (VMBR4 in my case) so that it uses specific network (192.168.6.x in my case)…

Also, when we are talking about that table with ports needed to be opened, are those source ports or destination ports? Because in iptables world, I can open port as source port or destination port for incoming or outgoing traffic.

For example, 35623 UDP broadcasts for discovery Outgoing UDP means that I need to open traffic, that is coming from this port or to this port 35623? Since its server side, but its labeled UDP broadcast, I assume it has to be opened on server side as outgoing port, source port. Or does app listen on this port for broadcasts, thus it has to be opened as destination port?