Great guide!
I used steemychicken1's guide to block all ports except 22 on my witness node. This had the unintended effect of blocking the port that upstart listened on.
A quick scan using netstat allowed me to see that upstart was listening on port 8769. Using the same commands for the guide linked above, I unblocked port 8769 and everything worked.
Thank you!