Do I need a firewall rule in place for the dude running on HexS to access itself? I can access everything else in the network and across the VLAN's but so far a no-go with ROS access to the HexS that dude is running on.

Depending on you firewall configuration you might need one.
The simplest way would be to accept in input chain from src-address-type=local to dst-address-type=local.

Depending on you firewall configuration you might need one.
The simplest way would be to accept in input chain from src-address-type=local to dst-address-type=local.

Exactly what I was missing. Thanks!