Route from LAN to Hercules

After a 10 years long hiatus I am messing around with Hercules again. I am
running Herc on a headless server and want to run x3270/telnet/ssh from
a laptop on the LAN. The server is 192.168.100.2 and the Herc
guest has an LCS device with address 192.169.100.12. So on the server
the routes are:

# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.100.1   0.0.0.0         UG    3      0        0 enp5s0
127.0.0.0       127.0.0.1       255.0.0.0       UG    0      0        0 lo
192.168.100.0   0.0.0.0         255.255.255.0   U     0      0        0 enp5s0
192.168.100.12  0.0.0.0         255.255.255.255 UH    0      0        0 tap0

The server has an iptables forwarding rule:
ACCEPT     tcp  --  0.0.0.0/0            192.168.100.12       tcp dpt:23

If I shell into the server I can use telnet to get a session with the guest. On the laptop I created a route:
# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.100.1   0.0.0.0         UG    20100  0        0 enp0s25
127.0.0.0       127.0.0.1       255.0.0.0       UG    0      0        0 lo
192.168.100.0   0.0.0.0         255.255.255.0   U     100    0        0 enp0s25
192.168.100.12  192.168.100.2   255.255.255.255 UGH   0      0        0 enp0s25

and I can ping and traceroute the guest OS:

# traceroute -n 192.168.100.12
traceroute to 192.168.100.12 (192.168.100.12), 30 hops max, 60 byte packets
 1  192.168.100.2  0.326 ms  0.295 ms  0.263 ms
 2  192.168.100.12  0.624 ms  0.956 ms  1.736 ms

But when I try x3270 or telnet the connection just hangs. What have I missed out?

Thanks
Robin
--