

Assuming that the ‘enter.domain.here’ is a masking of the real domain, I would have to wonder if the acme client is actually trying to use the http validation rather than DNS. You could pcap on the outside to look for it coming in to confir.
As for filtering to specifically allow their addresses, I think their system has a unique user agent that you could filter against, or use an inbound proxy to allow global access to the ‘/.well-known/acme-challenge/’ path while keeping the rest of the site blocked.






Firewalls are typically built using ‘in’ rules, but it’s not referring to ‘wan > lan’ but rather if the rule is processed on the ingress of the firewall or the egress.
Stateful firewalls sessions are always going to allow responses, the old request that someone needs a rule ‘both directions’ is something of a running joke at this point honestly.
A pcap would explain a lot, the fact that the error cites a specific domain does sound like an outbound attempt, but if it was a specifically inbound region block that wouldn’t add up.