No. That is a good question. You can disable it in /etc/firewalld/firewalld.conf
. Search for AllowZoneDrifting
in this conf and change yes to no.
From the manual:
Older versions of firewalld had undocumented behavior known as “zone drifting”. This allowed packets to ingress multiple zones – this is a violation of zone based firewalls. However, some users rely on this behavior to have a “catch-all” zone, e.g. the default zone. You can enable this if you desire such behavior. It’s disabled by default for security reasons.
Note: If “yes” packets will only drift from source based zones to interface based zones (including the default zone). Packets never drift from interface based zones to other interfaces based zones (including the default zone).
Possible values; “yes”, “no”. Defaults to “yes”.