diff --git a/extensions/Servers/Proxmox/Livewire/Firewall.php b/extensions/Servers/Proxmox/Livewire/Firewall.php
index 6804586c9..ea650dc62 100644
--- a/extensions/Servers/Proxmox/Livewire/Firewall.php
+++ b/extensions/Servers/Proxmox/Livewire/Firewall.php
@@ -1677,23 +1677,35 @@ class Firewall extends Component
                 $normalizedStateDestIP = strtolower(trim($stateDestIP));
                 $normalizedProtocol = strtoupper(trim($protocol));
                 
-                // Matching logic - check if both IPs from the log are present in the state
-                // Either in the same direction or swapped (for return traffic)
+                // Flexible matching logic - multiple levels of matching
                 $ipMatch = false;
+                $matchType = '';
                 
-                // Direction 1: Log source → Log dest matches State source → State dest
+                // Level 1: Exact bidirectional match (both IPs match in either direction)
                 if ($normalizedStateSourceIP === $normalizedSourceIP && $normalizedStateDestIP === $normalizedDestIP) {
                     $ipMatch = true;
+                    $matchType = 'exact';
                 }
-                // Direction 2: Swapped (return traffic)
                 elseif ($normalizedStateSourceIP === $normalizedDestIP && $normalizedStateDestIP === $normalizedSourceIP) {
                     $ipMatch = true;
+                    $matchType = 'exact-reversed';
+                }
+                // Level 2: Destination IP match (log dest matches either state IP) - catches related traffic
+                elseif ($normalizedStateSourceIP === $normalizedDestIP || $normalizedStateDestIP === $normalizedDestIP) {
+                    $ipMatch = true;
+                    $matchType = 'dest-partial';
+                }
+                // Level 3: Source IP match (log source matches either state IP) - catches related traffic
+                elseif ($normalizedStateSourceIP === $normalizedSourceIP || $normalizedStateDestIP === $normalizedSourceIP) {
+                    $ipMatch = true;
+                    $matchType = 'source-partial';
                 }
                 
-                // Protocol match
+                // Protocol match - be flexible
                 $protocolMatch = (empty($protocol) || $protocol === '-' || $normalizedProtocol === $stateProtocol);
                 
                 // Port match - check if destination port from log matches any port in state
+                // Also allow match if no port specified or if it's a partial IP match
                 $portMatch = false;
                 if (empty($destPort) || $destPort === '-') {
                     $portMatch = true; // No port specified, match all
@@ -1702,11 +1714,16 @@ class Firewall extends Component
                     if ($stateDestPort === $destPortNum || $stateSourcePort === $destPortNum) {
                         $portMatch = true;
                     }
+                    // For partial matches, also accept if protocol matches even if port doesn't
+                    if (!$portMatch && str_contains($matchType, 'partial') && $protocolMatch) {
+                        $portMatch = true;
+                    }
                 }
                 
                 // Log first potential match for debugging
                 if ($ipMatch && $protocolMatch && $portMatch && count($matchingConnections) === 0) {
                     Log::info('First match found', [
+                        'match_type' => $matchType,
                         'state_source' => $stateSourceIP,
                         'state_dest' => $stateDestIP,
                         'state_protocol' => $stateProtocol,