No DHCP for an LXC container while iptables counts the packets as ACCEPT: firewalld rejects them in its own nftables table
The iptables ACCEPT rule for udp/67 on lxcbr0 kept counting, and dnsmasq never saw a DHCPDISCOVER. With nftables, an accept is not final: firewalld's table hooks in after it and rejected everything from the bridge.
·5 mins