Firewalld Gateway Policy Isn’t Forwarding Ports to My VM
Asked by
MellowPine47
I'm setting up an AlmaLinux machine as a router using firewalld's gateway policy configuration. The basic filtering works as expected: incoming traffic is denied by default while permitted traffic is allowed. However, forwarding TCP ports 80 and 443 to a virtual machine at 10.42.0.2 does not work. I added these permanent policy rules and reloaded firewalld:
firewall-cmd --permanent --policy gateway-world-to-HOST --add-forward-port port=80:proto=tcp:toport=80:toaddr=10.42.0.2
firewall-cmd --permanent --policy gateway-world-to-HOST --add-forward-port port=443:proto=tcp:toport=443:toaddr=10.42.0.2
firewall-cmd --reload
The services running in containers on the VM are still unreachable from the WAN. It seems like traffic reaches the router but is not being forwarded onward to the VM. What configuration should I check?
Answers
Because the destination is a VM running containerized services, check the bridge and container networking as well as SELinux. The VM must be reachable from the router, and the services need to be listening on the VM’s address rather than only on a container-local interface. A container-focused firewalld configuration may be easier to troubleshoot than combining several independent rules.
Reply to this answer
Make sure the policy you modified is actually the active policy for traffic arriving on the WAN interface. Check the active and default zones, interface assignments, and the policy’s ingress and egress zones. It’s easy to add a rule to a policy that is not handling the packets you’re testing.
Reply to this answer
First check whether IPv4 forwarding is enabled on the router. The kernel setting should be enabled with net.ipv4.ip_forward=1, both at runtime and persistently through sysctl configuration. Also verify the complete topology, including the WAN interface, the VM network, and the VM’s default gateway.
Reply to this answer
Port forwarding needs more than the destination rewrite: the forwarded traffic must be allowed by the relevant policy, and return traffic needs a working route back through the router. Confirm that 10.42.0.2 uses the AlmaLinux router as its default gateway and that the VM’s own firewall allows ports 80 and 443. Packet captures on the WAN and VM interfaces can show where the traffic stops.
Reply to this answer
You can also implement the forwarding directly with nftables if firewalld’s policy abstraction is getting in the way. That gives you explicit control over the destination NAT, forwarding accept rules, interface paths, and masquerading, but it still requires IP forwarding and correct routing on the VM.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions