mjhjmtu

I have 2 zones in my VPS:

iredmail (active)
 target: default
 icmp-block-inversion: no
 interfaces: eth0
 sources: 
 services: smtp smtp-submission pop3 pop3s imap imaps ssh
 ports: 
 protocols: 
 masquerade: no
 forward-ports: 
 source-ports: 
 icmp-blocks: 
 rich rules: 


public (active)
 target: default
 icmp-block-inversion: no
 interfaces: 
 sources: <MY_IP>
 services: ssh dhcpv6-client http https
 ports: 22/tcp
 protocols: 
 masquerade: no
 forward-ports: 
 source-ports: 
 icmp-blocks: 
 rich rules:

I have the services http and https in the public zone and added "MY_IP" as the only source for this zone. I dont even have an interface for the public zone. When I try to connect to my http and https services with an IP that is not "MY_IP" I am able to do it. It is my understanding that if I add "MY_IP" as the only traffic source, "MY_IP" is the only one that is supposed to have access to the http and http services, if that is not the case, how can I prevent any traffic from a source other than "MY_IP" from reaching to the http and https services in the public zone? Thanks for the help.