Several of us have had problems with firewalld. Apparently, the configuration file for the service has a line that sets the firewall zone to “public” and should be “external”.
SSH into your box and manually edit /etc/firewalld/firewalld.conf. Change the line:
from:
DefaultZone=public
to:
DefaultZone=external
then reload the firewalld service.
See: Debian 12 (Bookworm) release and upgrading - #7 by Avron