The switch receives the packet on port 5 and it knows that it's coming from VLAN 10. And as it has VLAN 10 tagged on port 2, it then sends the packet out on port 2 with a VLAN 10 tag added to the packet.
That's because firewall and Proxmox are connected to vmbr1 and incoming connections from...