On 15.10.2023 20:31, Mai Ling wrote:
1) Why does the response from api goes to destination being primary
IP
of the host, instead of the IP alias of the web container?
Reply to TCP connection always goes to the source IP address. If
application did not explicitly select specific source IP when
establishing connection, kernel picks up one of suitable addresses. I
suppose kernel simply takes the first address assigned to the interface.
I have no idea how traffic from containers is mapped to the available
addresses, but I am sure firewalld is not involved in this decision.
2) Why does web can initiate outgoing to anywhere?
Educated guess - because source address does not match your zone definition.