It seems you 're right. I can access the server from its local LAN (192.168.3.0/24) but not from the other subnet 192.168.11.0/24, where I’m testing from.
The server didn’t have a route for 192.168.11.0/24 via ens18 so I added it.
sudo ip route add 192.168.11.0/24 dev ens18
but I still cannot get the server to route back the reply to an ssh session (connection time-out).