Windows Firewall misbehaving

I'm trying to implement Windows firewalls on our servers, and I've come across an oddity that I could do with some advice on:

So I have a service listening on ports 8099-8102TCP, and a matching firewall rule:

New-NetFirewallRule -Enabled true -Direction Inbound -Action Allow -Profile Domain -LocalPort 8099-8102 -Protocol TCP -DisplayName "(Local) Salto mgmt TCP in"

(default action is to block all traffic)

However, this I still can't get at 8100TCP remotely. So I've checked for deny rules (which would take precendence), I see none.
Next up, I do WTF auditing as per https://superuser.com/questions/1130078/how-to-tell-which-windows-firewall-rule-is-blocking-traffic – this gives me an event:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
  <EventID>5152</EventID> 
  <Version>0</Version> 
  <Level>0</Level> 
  <Task>12809</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8010000000000000</Keywords> 
  <TimeCreated SystemTime="2020-06-09T07:29:54.946996300Z" /> 
  <EventRecordID>900009</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4" ThreadID="32" /> 
  <Channel>Security</Channel> 
  <Computer>ATWIN-SaltoT2.bathspa.ac.uk</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="ProcessId">4</Data> 
  <Data Name="Application">System</Data> 
  <Data Name="Direction">%%14592</Data> 
  <Data Name="SourceAddress">172.23.25.136</Data> 
  <Data Name="SourcePort">58740</Data> 
  <Data Name="DestAddress">172.23.28.3</Data> 
  <Data Name="DestPort">8100</Data> 
  <Data Name="Protocol">6</Data> 
  <Data Name="FilterRTID">165768</Data> 
  <Data Name="LayerName">%%14610</Data> 
  <Data Name="LayerRTID">44</Data> 
  </EventData>
  </Event>

So I get a dump of firewall rules:

netsh wfp show filters

This gives me the offending rule (I think, FilterRTID matches filterID):

<item>
            <filterKey>{3b80c06b-ca26-40d2-b265-82b304ff1dc9}</filterKey>
            <displayData>
                <name>Query User</name>
                <description>Prompt the User for a decision corresponding this Inbound Traffic</description>
            </displayData>
            <flags/>
            <providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
            <providerData>
                <data>cc03000000000000</data>
                <asString>........</asString>
            </providerData>
            <layerKey>FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4</layerKey>
            <subLayerKey>{b3cdd441-af90-41ba-a745-7c6008ff2301}</subLayerKey>
            <weight>
                <type>FWP_UINT8</type>
                <uint8>8</uint8>
            </weight>
            <filterCondition numItems="1">
                <item>
                    <fieldKey>FWPM_CONDITION_ORIGINAL_PROFILE_ID</fieldKey>
                    <matchType>FWP_MATCH_EQUAL</matchType>
                    <conditionValue>
                        <type>FWP_UINT32</type>
                        <uint32>3</uint32>
                    </conditionValue>
                </item>
            </filterCondition>
            <action>
                <type>FWP_ACTION_BLOCK</type>
                <filterType/>
            </action>
            <rawContext>0</rawContext>
            <reserved/>
            <filterId>165768</filterId>
            <effectiveWeight>
                <type>FWP_UINT64</type>
                <uint64>9223372036854776256</uint64>
            </effectiveWeight>
        </item>

Namely 'Query User'/'Prompt yhe User for a decision corresponding to Inbound Traffic'

So why isn't it using the rule I set, and here does this 'Prompt user' rule spring from? (and why is it not prompting me?)

Questions questions. Any advice would be really welcome.

Jim