The replica needs clear network routes to ports on the primary: https://puppet.com/docs/pe/2021.6/system_configuration.html#firewall_standard