ok fixed - added cap_add NET_RAW - I also removed ufw entirely - will need to re-do this from scratch and check exactly what was going on