The last rule in chain do-reject is wrong. I was wondering why the connection keeps timing out instead of immediately getting a reject.
It is currently at drop when it should be reject, even the rule name is do-reject!
chain do-reject {
meta pkttype broadcast drop
ip saddr 224.0.0.0/4...