Firewalld Gateway Policy Isn’t Forwarding Ports to My VM

You can also implement the forwarding directly with nftables if firewalld’s policy abstraction is getting in the way. That gives you explicit control over the destination NAT, forwarding accept rules, interface paths, and masquerading, but it still requires IP forwarding and correct routing on the VM.

Port forwarding needs more than the destination rewrite: the forwarded traffic must be allowed by the relevant policy, and return traffic needs a working route back through the router. Confirm that 10.42.0.2 uses the AlmaLinux router as its default gateway and that the VM’s own firewall allows ports 80 and 443. Packet captures on the WAN and VM interfaces can show where the traffic stops.

First check whether IPv4 forwarding is enabled on the router. The kernel setting should be enabled with net.ipv4.ip_forward=1, both at runtime and persistently through sysctl configuration. Also verify the complete topology, including the WAN interface, the VM network, and the VM’s default gateway.

Make sure the policy you modified is actually the active policy for traffic arriving on the WAN interface. Check the active and default zones, interface assignments, and the policy’s ingress and egress zones. It’s easy to add a rule to a policy that is not handling the packets you’re testing.

Because the destination is a VM running containerized services, check the bridge and container networking as well as SELinux. The VM must be reachable from the router, and the services need to be listening on the VM’s address rather than only on a container-local interface. A container-focused firewalld configuration may be easier to troubleshoot than combining several independent rules.