Re: dummy net iface?

[listy <listy@localities.work>]

Yes I did/do have net.ipv4.ip_forward = 1
Then I must be doing something wrong or not doing something.
I run a container which listens on a dummy iface, well, 
'pasta' does it on behalf of 'podman'

-> $ nmap 10.9.4.7 -p 5350
...
5350/tcp open  nat-pmp-status

-> $ nmap 10.9.4.7 -p 5350 -sU
...
5350/udp open|filtered nat-pmp-status

what listens is a dns recursor, then 'firewalld' looks like so:

-> $ firewall-cmd --list-all --zone=mine-fwd-dummy
mine-fwd-dummy (active)
   target: default
   icmp-block-inversion: no
   interfaces: forwarder-dummy
   sources:
   services:
   ports:
   protocols:
   forward: yes
   masquerade: no
   forward-ports:
	port=53:proto=tcp:toport=5350:toaddr=10.9.4.7
	port=53:proto=udp:toport=5350:toaddr=10.9.4.7
   source-ports:
   icmp-blocks:

which results in:
-> $ nft list table inet firewalld
...
         chain nat_PRE_mine-fwd-dummy_allow {
                 meta nfproto ipv4 tcp dport 53 dnat ip to 
10.9.4.7:5350
                 meta nfproto ipv4 udp dport 53 dnat ip to 
10.9.4.7:5350
         }
...

forwarder-dummy is: 10.9.4.7

yet

-> $ nmap 10.9.4.7 -p 53
...
53/tcp closed domain

same for 'udp'
I'm on Centos 9 with 6.12.74-1.el9.x86_64
If I'm missing something - what that might be..
thanks, L