Trying to self-train on firewalld I set up apache and configured the zones as follows:[root@localhost ~]# firewall-cmd --get-active-zoneswork  sources: 192.168.122.1public  interfaces: ens3[root@localhost ~]# firewall-cmd --zone=work --list-allwork  interfaces:  sources: 192.168.122.1  services: dhcpv6-client ipp-client ssh  ports:  masquerade: no  forward-ports:  icmp-blocks:  rich rules:[root@localhost ~]# firewall-cmd --zone=public --list-allpublic (default, active)  interfaces: ens3  sources:  services: dhcpv6-client http https ssh  ports:  masquerade: no  forward-ports:  icmp-blocks:  rich rules:My expected result is that traffic from the hypervisor would match the work zone and since http isn't allowed for that zone for it to be dropped. However I'm still able to get to the web page from there: I know the traffic is matching the public zone because removing the http and https services causes web traffic to stop and adding them back to the public zone restores service while making the same modifications on the work zone does nothing.I'm sure it's a failure of my understanding but I can't spot it.UpdateStill having this issue. If I remove the interface from public and add it to work it starts to work but that's likely because all ens3 traffic will be going to that zone now. I did a iptable -Z to zero out the packet counts and did verify that the chains associated with the public zone are getting the packets.Interestingly, if I do the --add-source so that it adds the traffic to the drop or block zones it works how I would expect (traffic is dropped/rejected regardless of what services are configured on the public zone).Here's the output from netstat on the server running the firewall:[root@localhost ~]# netstat -rnKernel IP routing tableDestination     Gateway         Genmask        Flags   MSS Window   irtt Iface0.0.0.0         192.168.122.1   0.0.0.0        UG        0 0           0 ens3192.168.122.0   0.0.0.0         255.255.255.0  U         0 0           0 ens3
Why is traffic matching the public zone instead of the desired zone?
linux;centos;iptables;firewall;firewalld