All systems are Linux, and no, the internal machine has full accessibility to TCP/8333 on the gateway machine. Further to that, the gateway machine is open on TCP/8333 to everyone so it can be a better part of the bitcoin network at large.
Background: I'm not new to Linux or to networking (doing both since 1996). Not trying to be 'snarky', you started with a plausible explanation and didn't know what I'd tried
Looking at the debug.log I see numerous times that the internal peer is trying to connect to the correct IP and port but then is disconnecting and 'trying again'
Log excerpt from earlier:
trying connection 192.168.1.1 lastseen=0.0hrs
connected 192.168.1.1
send version message: version 60002, blocks=199878, us=0.0.0.0:0, them=0.0.0.0:0, peer=192.168.1.1:8333
Flushed 11442 addresses to peers.dat 32ms
socket no message in first 60 seconds, 0 1
disconnecting node 192.168.1.1
I can telnet to 8333 on 192.168.1.1 just fine, so I'm confused if there's some authentication thing that's needed for 'trusted peers', or what it is that I'm missing.