Guest OS network troubleshooting help - Can ping out & in but can not apt update / wget etc.

I've been playing with Proxmox server for the first time and I'm close but missing something. After screwing with it all day I'm sure I'm missing something simple. I can ping the Guest OS from WAN. Guest OS can ping out. DNS works fine etc. but I am unable to wget or apt update as the connection fails.

I've gone as far as disabling all firewalls but nothing has changed. Any ideas? Routing tables etc. are below.

On the Guest OS (debian buster)

root@UBNT:~# ip route default via 94.130.50.129 dev eth0 onlink 94.130.50.128/26 dev eth0 proto kernel scope link src 94.130.50.136 

/etc/network/interfaces:

auto lo iface lo inet loopback auto eth0 iface eth0 inet static address 94.130.50.136 netmask 255.255.255.255 gateway 94.130.50.129 # netmask 255.255.255.192 pointtopoint 94.130.50.129 

On the Proxmox host:

#route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 94.130.50.129 0.0.0.0 UG 0 0 0 vmbr0 10.10.10.0 0.0.0.0 255.255.255.0 U 0 0 0 vmbr1 94.130.50.128 94.130.50.129 255.255.255.192 UG 0 0 0 vmbr0 94.130.50.128 0.0.0.0 255.255.255.192 U 0 0 0 vmbr0 

/etc/network/interfaces:

### Hetzner Online GmbH installimage source /etc/network/interfaces.d/* auto lo iface lo inet loopback #iface lo inet6 loopback auto enp0s31f6 iface enp0s31f6 inet manual auto vmbr0 iface vmbr0 inet static address 94.130.50.153 netmask 255.255.255.192 gateway 94.130.50.129 pointtopoint 94.130.50.129 broadcast 94.130.50.191 bridge_ports enp0s31f6 bridge_stp off bridge_fd 0 # route 94.130.50.128/26 via 94.130.50.129 up route add -net 94.130.50.128 netmask 255.255.255.192 gw 94.130.50.129 dev vmbr0 auto vmbr1 iface vmbr1 inet static address 10.10.10.1 netmask 255.255.255.0 bridge_ports none bridge_stp off bridge_fd 0 post-up echo 1 > /proc/sys/net/ipv4/ip_forward post-up iptables -t nat -A POSTROUTING -s '10.10.10.0/24' -o vmbr0 -j MASQUERADE post-down iptables -t nat -D POSTROUTING -s '10.10.10.0/24' -o vmbr0 -j MASQUERADE # iface enp0s31f6 inet6 manual # address 2a01:4f8:10b:2823::2 # netmask 64 # gateway fe80::1 

*Sorry some of this is a bit messy I've been trying things left n right.