Got caught out by some of firewalld's weirdness earlier. Including a CIDR range in any zone excludes it from 'public', because those zones get processed first...pays to read the lower level rules aways (NFT in this case, bleeee)