Apace Reverse Proxy to Docker Container - CSF Breaking Container App

Question

I've been at this all day now and can't seem to figure it out.

I installed listmonk on my server and set up an Apache Reverse Proxy to it:

<VirtualHost listmonk.ygoprodeck.com:80>
    ServerName listmonk.ygoprodeck.com
    ProxyPreserveHost On
    ProxyPass / http://localhost:9000/
    ProxyPassReverse / http://localhost:9000/
</VirtualHost>
<VirtualHost <SERVERIP>:443>
    ServerName listmonk.ygoprodeck.com
    SSLCertificateFile /etc/ssl/certs/listmonk-selfsigned.crt
    SSLCertificateKeyFile /etc/ssl/private/listmonk-selfsigned.key
    ProxyPreserveHost On
    ProxyPass / http://localhost:9000/
    ProxyPassReverse / http://localhost:9000/
    SSLEngine On
    SSLProxyEngine On
</VirtualHost>

This worked fine and I could access the application through https://listmonk.ygoprodeck.com/ and the application worked fully.

However, I then activated CSF on the Server and immediately I couldn't access Listmonk through the URL above.

I enabled docked settings in CSF which made no difference and the only way for me to fix it was to add the following to TCP_IN and TCP_OUT:

9000,9432,5432

After that, it started working fully again. If I only added port 9000 then I could reach the app via the URL but the app couldn't connect to the postgres database. However, this seems like bad practice, and I think the nature of the Reverse Proxy should allow me to not have to externally expose these ports.

Any suggestions? I'm on the verge of giving up.

CSF Docker Settings:

DOCKER = 1
DOCKER_DEVICE = docker0 
DOCKER_NETWORK4 = 172.17.0.0/16,172.18.0.0/16
DOCKER_NETWORK6 = 2001:db8:1::/64