Solved it - I thought I’d checked iptables against the Mangoh Green, but as described in the user’s guide,
Mangoh gets rules from /etc/iptables/rules.v4
FX30 ignores /etc/iptables/rules.v4 and instead uses /etc/iptables.rules
So I needed to allow incoming responses to established connections:
sed “s/-A INPUT -i rmnet0 -j DROP/-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT\n&/” -i /etc/iptables.rules ; reboot
