Cloudflared tunnel won’t establish port 7844

Cloudflare newbie here. Struggling with a tunnel that won't establish itself. Running around in circles with AI sending me on wild goose chases.

Am pretty sure that a few days ago I did have a tunnel that was UP and running, but now it won't connect. So much testing and tinkering that I am starting to doubt myself and my grip on reality. I have tried refreshing the key. No change.

cloudflared is running on Windows Server 2022 and the service is Started. I have tried uninstalling and reinstalled it. No change.

Tried stopping the Windows service and then running the cloudflared.EXE manually as follows:

cloudflared tunnel run –token-file C:\ProgramData\cloudflared\token

but in the Connectivity Pre-Checks, it shows that whilst DNS Resolution is fine (region1.v2.argotunnel.com) the UDP and TCP Connectivity is a Fail. I see "QUIC connection failed" and also "HTTP/2 connection is blocked or unreachable". Cloudflare API is a PASS however, the API is reachable.

The advice given in the logs is "Allow outbound QUIC traffic on port 7844 or use HTTP2.

As far as I know, port 7844 is permitted. No restrictions in the firewall. I explicitly put a firewall policy in just for this server, just to be sure of no restrictions. No change. Also temporarily disabled Windows Firewall on the VM, no change.

Our environment uses Fortinet firewalls, so I have been wondering whether there is something specific about the traffic that it might be objecting to? Could it be an upstream ISP firewall blocking me somewhere?

EDIT — just adding that we're in Melbourne, Australia and using Vocus for Internet connectivity — I checked their support pages and found that they've had one of their submarine international links down and have been changing their routing. They made some changes Friday which roughly coincides with my issue I think. Plus we had a Fortigate firewall in that location refusing to communicate with Fortiguard as well. I may need to try spinning up another tunnel in another site via a different ISP and see if I get a different result.