Accessing the WAN from a VM on a LAN

[krikey]

I have PVE 8.2.7 and have set up port forwarding so that when port 8007 is used on the WAN Proxmox IP address, it gets forwarded to the service running on the VM called BACKUP which is a virtualised PBS. This works well as I'm able to access :8007 (firewalled) from the internet to manage PBS.

BACKUP is connected via vmbr99 to eno2 on the network 10.0.10.0/24 which is my local and physical network.

However, BACKUP itself is unable to access the internet. I've tried pinging 1.1.1.1 and other IP addresses but no luck.

I've fully disabled the PBS firewall temporarily at the datacentre level to test.

Here's a redacted copy of my /etc/network/interfaces file

auto vmbr0
iface vmbr0 inet static
        address xxx.xxx.xxx.xxx/24
        gateway xxx.xxx.xxx.xxx
        bridge-ports eno1
        bridge-stp off
        bridge-fd 0

auto vmbr99
iface vmbr99 inet static
        address 10.10.10.1/24
        bridge-ports eno2
        bridge-stp off
        bridge-fd 0
        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o vmbr0 -j MASQUERADE
        post-up /root/dnat.sh
        post-down iptables -t nat -D POSTROUTING -s 10.10.10.0/24 -o vmbr0 -j MASQUERADE
#local lan

and this is the /root/dnat.sh file

sleep 60
iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 8007 -j DNAT --to-destination 10.10.10.100:8007

What do I need to adjust to allow traffic from the BACKUP VM onto the WAN?