Once upon a time, Steven Tardy sjt5atra@gmail.com said:
The “ICMP unreachable” should be a dead giveaway. . .
You cut out the part of the email where the OP said that the UEFI system was ignoring the next-server part of the DHCP reply and trying to TFTP to the DHCP server instead of the TFTP server. Of course that got ICMP unreachable, but it isn't a firewall problem.
To the OP: can you post a full tcpdump decode of the DHCP offer? I seem to remember having some issue with ISC DHCP in the past not getting the next server set correctly - maybe a packet will jog some memory (and I'll go try to grab the same from my dnsmasq DHCP for comparison).