Health checks fail from the load balancer subnet while user traffic still works

Users can still reach the app, but the load balancer drains targets because health checks originate from a path the firewall policy never allowed.