Forwarding packets of caddy are being rejected by firewall

[Abastro]

I set up caddy with following quadlet files and Caddyfile:

caddy.container:

# caddy.container
[Container]
ContainerName=caddy
Image=docker.io/caddy:latest
Network=bridge
PublishPort=80:80
PublishPort=443:443
Volume=/etc/caddy/Caddyfile:/etc/caddy/Caddyfile
Volume=caddy-data:/data
Volume=caddy-config:/config
# Specify size as estimation fails
UserNS=auto:size=1024

[Service]
Restart=always

[Install]
WantedBy=default.target

caddy-config.volume:

# caddy-config.volume
[Volume]
VolumeName=caddy-config

caddy-data.volume:

# caddy-data.volume
[Volume]
VolumeName=caddy-data

Caddyfile:

arm.abastro.xyz {
    respond "Currently supports:"
}

I think I've set things up right, but I cannot connect to the caddy through internet, it goes "connection: timed out".
The only firewall rules for FORWARD is NETAVARK_FORWARD and LOG, REJECT:

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
NETAVARK_FORWARD  all  --  anywhere             anywhere             /* netavark firewall plugin rules */
LOG        all  --  anywhere             anywhere             LOG level info prefix "FORWARD:REJECT:"
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

the packets are rejected:

2025-04-03T15:29:32.113829+00:00 abastro-personal-arm kernel: FORWARD:REJECT:IN=enp0s6 OUT=podman0 MAC=02:00:17:01:ad:1a:00:00:17:71:a5:dd:08:00 SRC=(my ip) DST=10.88.0.5 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=26568 DF PROTO=TCP SPT=33904 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0
2025-04-03T15:29:32.219974+00:00 abastro-personal-arm kernel: FORWARD:REJECT:IN=enp0s6 OUT=podman0 MAC=02:00:17:01:ad:1a:00:00:17:71:a5:dd:08:00 SRC=(my ip) DST=10.88.0.5 LEN=60 TOS=0x00 PREC=0x00 TTL=53 ID=15513 DF PROTO=TCP SPT=33908 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0

As far as I understand, podman sets up its own firewall rules for the containers,
where NETAVARK_FORWARD does the work.
Why is it blocking the intended traffic?

[Abastro]

Interestingly, gpt is good at this kind of troubleshooting. I did not know connection to internet is .
May I know why firewall rules for opening port is not natively supported?