I have no experience of UT server configuration.
There seems to be differing views on the query port setting.

It appears to me that it automatically defaults to join port +10, but others say join port +1.
This may be UT version dependent.

There also appears to be confusion about TCP vs UDP port opening.
For Q3 it is generally accepted (some may argue) to open ports for udp and tcp.

If it were my server, I would throw everything open and see attempt to add the server using every query port from join port upwards.
i.e. join port = 7777 then try every query port between 7777 and 7787 as a minimum.

If/when the server is successfully added you can start buttoning up the security again.

Many people run servers for years with no firewall protection without incident (though I don't recommend going to that extreme in the medium to long term).

The problems are solved.
It was a OPNsense issue.
Closing this case.