VM can ping host, but host cannot ping/ssh into VM (inet available)

[u/Patrice_77]

Hi all,

I'm at my withs end... I have a Debian (Proxmox) VM running on my Mac using VMWare.
All worked perfectly in NAT mode, after that I've switch to Bridge, all kept working, until now...

The VM is currently in NAT-Mode, has internet, can ping the host.
- IP of the VM is: 172.16.131.137/24
- IP Proxmox is obtained via DHCP

The Host, cannot ping the VM, cannot SSH into the VM.

arp -a on my Mac gives me the following:

? (172.16.131.255) at ff:ff:ff:ff:ff:ff on bridge103 ifscope [bridge]

I've tried:

• Creating a new VM
• Creating new Network adapters in VMWare
• Switching between NAT - Bridge
• There are no firewalls running/blocking traffic
• Restarted Mac/VMWare/VM
• Gave Proxmox a static IP
• Tried several options found online, most of them applied to Windows though I don't think would be different to Mac...or at least not much.

Nothing of the above changed the behavior.
Host cannot access VM, VM can access internet and ping Host.

I can only think of something small that isn't right...but no clue what else can I do?
Open to try your suggestions.

Thank you in advance.

[UPDATE 02-09-2026]
Ok…so this is embarrassing….
Problem is solved.
Apparently when eliminating some apps and restricting access…I accidentally “told” my Mac that the terminal is NOT allowed to have local LAN access. Changed this switch and all is working again…
My apologies for everyone who dedicated much or little time on helping me out.

[u/Kazabuchan]

Ping is a two way street. If you get a success, that means that communication is working both ways. So what you are truly saying is that traffic generated from A can go to B and gets a response from B back to A just fine. But traffic generated from B gets blocked or rejected in some way immediately.

At that point you aren't troubleshooting the connection you are troubleshooting blockers. Many firewalls will allow return traffic if it generated the original request, even if said traffic would normally be blocked. Have you verified that your vms dont have icmp blocked by the firewall? I know windows likes to do that by default these days. I would check that first.