A STATEFUL firewall with “ip any any” can and will still block asymmetric communications due to the firewall keeping track of state (hence tha name stateful firewall). Tcpdump on your servers /other/ NICs and you’ll see the tftp traffic leaving your server on some other NIC (probably on with the default route). The upstream firewall will then block the tftp response if it never saw the tftp request (due to asymmetry).