You need both, because the preshared key is what authenticates your users' devices and your MX to one another. The username/password is required to authenticate the users themselves ... View more

By default, any incoming traffic is blocked unless it has a forwarding rule or NAT, which seems to be the case in your case.   You don't need to use software to check this, just check the rules created.   You don't need an additional rule, since L3 rules are intended for outside.   Check the documentation.   https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Port_Forwarding_and_NAT_Rules_on_the_MX ... View more

I would advise following some of the initial steps @ww suggested.  We can confirm a NAT router in front of us by examining the Appliance status page and selecting the "uplink" tab. If the WAN reads a private IP, we are likely behind a NAT. Similarly to @Brash's comments, if we have a public address configured on the WAN port and the public IP under the "General" header is different, we could be impacted CGNAT.    Another test to help confirm if the traffic is even reaching the MX is to take a packet capture on the MX WAN/internet port and then filter for either the public address initiating the connection to the server or the port the connection is to happen on (6180 in this case).    The following documentation helps cover NAT and port forwarding troubleshooting: https://documentation.meraki.com/MX/NAT_and_Port_Forwarding/Troubleshooting_Port_Forwarding_and_NAT_Rules ... View more