In desperation, I took a backup of the VM and spun it up in the office. It worked fine. WTF? That made no sense at all.
@NAB I found an utterly weird problem with accessing a home system from outside the home using giffgaff. Which didn't work, with incomprehensible error messages. But accessing the same port from outside the home using something other than giffgaff, eg someone else's wifi, worked fine.
Turned out that giffgaff were somehow, for some reason, blocking access to some combination of that particular (unusual) port number and a Duck DNS domain name and a Let's Encrypt certificate. It took several attempts to get through to a tech support person who knew that this was a thing, but then they removed the block following which it's been working fine.
So it's not unknown for mobile providers to put really weird constraints on what you would expect to be normal internet operations.
@TimWardCam @NAB
I had a similar issue with Vodafone in the UK many moons ago
The trick used to be switching your mobile internet APN from "wap" to "internet" to get normal internet access.
I seem to recall other providers have something similar but what you may be able to access varys depending on what your package provides.