CentOS/RHEL, Kubernetes, Calico - firewall kérdés

Adott egy több gépes Kubernetes cluster, amin engednem kellene egymás között a korlátlan beszélgetést, amit a Calico kezelne ugye:

6: vxlan.calico: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN group default
   link/ether 66:27:cf:7e:04:57 brd ff:ff:ff:ff:ff:ff
   inet 192.168.192.192/32 scope global vxlan.calico
      valid_lft forever preferred_lft forever
   inet6 fe80::6427:cfff:fe7e:457/64 scope link
      valid_lft forever preferred_lft forever
7: caliadcbd3f4089@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP group default
   link/ether ee:ee:ee:ee:ee:ee brd ff:ff:ff:ff:ff:ff link-netnsid 0
   inet6 fe80::ecee:eeff:feee:eeee/64 scope link
      valid_lft forever preferred_lft forever
15: calie01777fb239@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP group default
   link/ether ee:ee:ee:ee:ee:ee brd ff:ff:ff:ff:ff:ff link-netnsid 1
   inet6 fe80::ecee:eeff:feee:eeee/64 scope link
      valid_lft forever preferred_lft forever

Elvileg hozzáadtam a tűzfalhoz a 192.168.0.0/16 tartomány engedését, külön zónába, amihez hozzáadtam a vxlan.calico interfészt:

work (active)
   target: default
   icmp-block-inversion: no
   interfaces: vxlan.calico
   sources:
   services: cockpit dhcpv6-client ssh
   ports:
   protocols:
   forward: no
   masquerade: no
   forward-ports:
   source-ports:
   icmp-blocks:
   rich rules:
      rule family="ipv4" source address="192.168.0.0/16" accept

Valamit elbaszok, mert eldobja a `cali*` interfész forgalmát:

[Mon Jan 3 19:40:59 2022] FINAL_REJECT: IN=vxlan.calico OUT=cali36ee08b4230 SRC=192.168.84.64 DST=192.168.186.2 ...
[Mon Jan 3 19:40:59 2022] FINAL_REJECT: IN=vxlan.calico OUT=calie69163f08b8 SRC=192.168.192.192 DST=192.168.186.1 ...
[Mon Jan 3 19:41:00 2022] FINAL_REJECT: IN=vxlan.calico OUT=calie69163f08b8 SRC=192.168.84.64 DST=192.168.186.1 ...

Mi az, ami felett átsiklottam?