docker ports filtered by firewalld - docker

Question

I'm on CentOS 7.9 and I need to get dockers to work with a firewalld configured.
However, the port is always filtered when firewalld is started... Unless I tried to connect to it over localhost.
On this machine (myhost), I have a running container listening on port 55123 :
# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
6878f1d6152d registry.example.com/my-image:22.1.1 "/entrypoint.sh" 2 weeks ago Up 10 minutes 0.0.0.0:55123->55123/tcp myhost_myservice
# netstat -lntp |grep docker-proxy
tcp 0 0 0.0.0.0:55123 0.0.0.0:* LISTEN 27091/docker-proxy
I did add the port to firewalld :
# firewall-cmd --zone=public --add-port=55123/tcp --permanent
# firewall-cmd --reload
I have a zone docker and a zone public, and I added my interfaces to the public zone to be sure :
# firewall-cmd --get-active-zones
docker
interfaces: br-e7b57dXXXXXX docker0
public
interfaces: ens192 ens224 ens256
I tried a restart of firewalld and then docker service but still getting filtered :
# nmap myhost -Pn -p 55123
Nmap scan report for myhost (XXX.XXX.XXX.23)
Host is up.
PORT STATE SERVICE
55123/tcp filtered unknown
Nmap done: 1 IP address (1 host up) scanned in 0.25 seconds
but all good on localhost :
# nmap localhost -Pn -p 55123
Nmap scan report for myhost (XXX.XXX.XXX.23)
Host is up.
PORT STATE SERVICE
55123/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds
I have enabled docker metrics on port 9323 directly on the host (myhost), and this port is well opened
# nmap myhost -Pn -p 9323
Nmap scan report for myhost (XXX.XXX.XXX.23)
Host is up.
PORT STATE SERVICE
9323/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds
If I stop firewalld, I immediatly get :
# nmap myhost -Pn -p 55123
Nmap scan report for myhost (XXX.XXX.XXX.23)
Host is up.
PORT STATE SERVICE
55123/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 0.23 seconds
My Firewalld configuration :
# firewall-cmd --zone=docker --list-all
docker (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: br-e7b57dXXXXXX docker0
sources:
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
# firewall-cmd --zone=public --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens192 ens224 ens256
sources:
services: dhcpv6-client ssh
ports: 9323/tcp 55123/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
I'm a bit lost of why it isn't working.
There is one thing bit weird, we have a network with non-standard private network. Our network is on something like 110.2.0.0/16.