A direct firewall fix survives until reboot while NetworkManager restores a different zone binding for the new uplink profile during a failover rehearsal

The rule exists and the interface moved to a different policy domain underneath it. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.