Does not appear being fixed but further confused.
Port scan showing wan port 22 open but it is not reachable (probably missing forwarding). Instead the honey pot can be reached on the wan port 2525 only, which is albeit stealth on a port scan.
Output from haas-proxy.postinst:
iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
Whilst showing in LuCI
Chain zone_wan_prerouting (References: 2)
Pkts. Traffic Target Prot. In Out Source Destination Options
838 48.77 KB MARK tcp * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 MARK set 0x10
838 48.77 KB DNAT tcp * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 /* haas / to:[wan.ip]:2525
5369 262.71 KB prerouting_wan_rule all * * 0.0.0.0/0 0.0.0.0/0 / !fw3: user chain for prerouting */
there is no such output from iptables -S
and iptables -S zone_wan_prerouting
reveals
iptables: No chain/target/match by that name.