Based on the provided log message, it is likely the issue was caused by an out-of-sequence SYN/ACK packet that did not have a corresponding entry in the conntrack (connection tracking) table of the IPFire firewall. The log message shows “DROP_CTINVALID,” indicating that the firewall dropped a packet deemed as invalid in the context of the existing connection tracking entries.
An out-of-sequence SYN/ACK packet might be the result of a few network latency or packet reordering or failure of some component of the network stack of the host machine: possibly some network conditions could have caused packets to be delayed or arrive out of order. In such situations, the firewall’s conntrack table may not have the expected entry for the incoming SYN/ACK packet, leading to the packet being dropped.
I do not think what happened has anything to do with the thread you linked, which I opened in the LE forum. That thread is about an hypothesis that I am not sure at all is correct, concerning the renewal of LE certificates when reverse path filtering is set to strict in the kernel. That is a setting that prevents forwarding of packets to interfaces that have no reason to receive that traffic.
At the time I supposed this was the reason LE servers would not receive an answer from my web server in the orange network, because when I dropped the strict flag it worked. However since then I researched the details of what that setting really means, and I could not find a reason to explain how this could happen. It could have been just a coincidence. I am waiting to test this next time my certificate is due for renewal.