diff --git a/extensions/Servers/Proxmox/Livewire/Firewall.php b/extensions/Servers/Proxmox/Livewire/Firewall.php
index 35c424131..603edf3cd 100644
--- a/extensions/Servers/Proxmox/Livewire/Firewall.php
+++ b/extensions/Servers/Proxmox/Livewire/Firewall.php
@@ -1709,19 +1709,16 @@ class Firewall extends Component
                 // Protocol match - be flexible
                 $protocolMatch = (empty($protocol) || $protocol === '-' || $normalizedProtocol === $stateProtocol);
                 
-                // Port match - check if destination port from log matches any port in state
+                // Port match - destination port from log MUST match a port in state
                 $portMatch = false;
                 if (empty($destPort) || $destPort === '-') {
-                    $portMatch = true; // No port specified, match all
+                    $portMatch = true; // No port specified in log, match all
                 } else {
                     $destPortNum = (int)$destPort;
+                    // Destination port must match either state's dest or source port (for return traffic)
                     if ($stateDestPort === $destPortNum || $stateSourcePort === $destPortNum) {
                         $portMatch = true;
                     }
-                    // For source-match type, be more flexible on ports if protocol matches
-                    if (!$portMatch && $matchType === 'source-match' && $protocolMatch) {
-                        $portMatch = true;
-                    }
                 }
                 
                 // Log first potential match for debugging