RBE970/RBE971 Routing Issues

I have an Orbi RBE970/RBE971 mesh environment that was set to auto-upgrade, but I noticed it was still running 9.12.4.16 even though the firmware update page said that upgrades were available. I used the online upgrade to the offered 12.1.10.12.

After the upgrade, I am seeing some LAN to LAN network connections appear to the server on the connection (HTTP, SSH, etc.) to come from the internet interface.  This prevented connections due to firewall rules on my servers that only allow connections from my internal LAN network IP range.

Oddly, some connections between internal hosts do not exhibit this behavior.

Additionally, connections from internal hosts to my internet facing IP address are no longer forwarded to the configured port forward host.  And again, this is inconsistent depending on what host I initiate the connection from.

I manually updated to 12.1.11.15, but that did not change any behavior.

The Protection Engine was enabled, but I disabled it and rebooted all devices, and there was no change.

The only pattern that I can find is that the different and unexpected/undesired behavior is to/from virtual machines on a VMware ESXi server.  But it's not for all services.

To make this real, I have an internal subnet of 172.x.x.0/24.  Let's call that network $A.  Here are my hosts and ip addresses:

Orbi router: $A.254

MacBook1 Ethernet directly connected to Orbi router: $A.8

MacBook1 Wireless: $A.9

MacBook2 Wireless: $A.111

Linux Server in VMware: $A.1

Windows 11 in VMware: $A.138

Internet network interface: $B

Linux iptables firewall only allows connections from $A.0/24 and a handful of trusted internet hosts.

Port forwarding is configured on the Orbi router for several services including SSH, HTTP, HTTPS, etc. to $A.1.

ssh from MacBook1 and MacBook2 to $A.1 fails because the Linux server ($A.1) sees it as coming from $B.

ssh from MacBook1 to MacBook2 works just fine.

ssh from Windows 11 to Linux server (both in VMware environment) works fine.

HTTP connections from MacBook1 and MacBook2 to $B (which is port forwarded to $A.1) work just fine.

HTTP connections from $A.1 to $B (which is port forwarded back to $A.1) timeout.  This is not a firewall issue.

As soon as I open SSH in the Linux firewall to allow connections from $B, all works.  netstat and who confirm the connection is coming from $B even though the client connections started on same subnet.

I pulled the debug logs from the router, but I can't see anything that looks out of place in the routing or interface definitions.  I may not know exactly what to look for.

I thought I would downgrade to see if the problem went away, but it seems you can't go back to 9.x from 12.x.

Any thoughts on how best to diagnose this further would be more than welcome.