Can't see VM from different subnets

I just created a VM on one of my TrueNAS servers. It’s running Debian 12.
The server’s IP is 192.168.2.2, the VM’s is 2.3.
I can surf the Internet from a browser in the VM.
I set the proper host override in my pf resolver. I can ping the VM by both IP address and host name from any subnet on my LAN except for the VM’s host. When I ping by host name it pings its own 2.2 address and shows success. When I try to ping by IP, it times out.
If I enter the IP address into a browser on a computer on any of my internal subnets, the nginx default homepage shows up.
If I enter the host name on a computer on the same subnet, the default homepage also shows up. If I enter the host name from a different subnet, I get a ‘server dropped the connection’ error.
I have a port forward set up for external requests like so:

I feel like I’ve hit all the things I need to do, but obviously, something’s not right.
I’ve never dealt with VMs before so there may be steps I’m missing.

I’d definitely appreciate some help.

It looks like I’m getting a 525 error when trying to connect from outside the network, but I don’t know why it’s trying to connect via SSL in the first place.

Since you can’t ping the VM from the host: Is that VM’s NIC plugged directly into the NIC of the host or have you created a network bridge?
Without a bridge there’s no communication possible between a host and a VM.

There is only one NIC. Both IPs are assigned to it. Each IP has a distinct MAC address.

But are you using a bridge? The following still applies

Those directions are a bit daunting.
Kill all VMs and apps. Remove all NICs from VMs. Yikes.
I’ll give it a shot, but that doesn’t explain why I can’t get to the server from a host name on another subnet, or from the Internet.

Both IPs are assigned to it? Is this actually in Truenas itself?

Because the IP of the VM shouldn’t be somewhere in the configuration of Truenas but only in the networking config of the VM itself.

I followed the directions from that YT video and was able to successfully set up a bridge. I didn’t even lose any fingers…

No, the TN box is statically assigned its IP address, the VM I believe is currently set up with DHCP but the DHCP server is statically assigning the IP address via MAC to it. I’ll have to go into the VM and change that to static as well, but for now, its IP address is correct and will not change.