Fedora's ability to forward ports using the apparently "native" networking software, firewalld, appears to continue to be broken beyond credulity. Please note that it hasn't really worked since at least Fedora 19 (see https://serverfault.com/questions/541087/fc19-firewalld-debugging-help-requested-ports-not-forwarding)

Note that it can't even "permanently" put an interface into a given zone in the current (21) release (with all updates through to this date) - a fundamental capability for this software, to be sure, as evidenced here, https://serverfault.com/questions/683783/fedora-21-firewalld-firewall-cmd-wont-permanently-assign-interfaces-to-zones/683792#683792.

As suggested by the "accepted answer" under this question,


IP tables is still in use "under the sheets" with firewalld (firewall-cmd). I have had NO SUCCESS whatsoever with getting firewalld (firewall-cmd) to successfully do any port forwarding - not that I've tried everything possible, but I've tried a lot - and it makes me wonder if it's even possible.

Somehow, some way, we need to know if we should even BOTHER with this codeline. WHY ON EARTH should we spend DAYS of our time, individually (and collectively many man-years) if the codeline is so inept?! Maybe the authors should Pull The Code until it's READY for prime-time? MAYBE someone should say, "No, use ip-tables until we fix this thing, quit wasting your time, sorry!"

What I can tell you DOES NOT WORK is a most basic example:

Take the forwarding of a port of obscurity, say, 9876, from an external interface to port 22, the SSH port, to a particular internal system. So, on a newly installed system, after sorting out the IP addresses of the interfaces, assigning them permanently to their respective zones (see https://serverfault.com/questions/683783/fedora-21-firewalld-firewall-cmd-wont-permanently-assign-interfaces-to-zones/683792#683792), the forwarding is then assigned. First, the port is "opened" and then "forwarded" using something like this:

firewall-cmd --zone=external --add-port=9876/tcp
firewall-cmd --zone=external --add-forward-port=port=9876:proto=tcp:toport=22:toaddr=

The problem is, this does NOT work. (The result is a simple timeout, nothing found in the logs.) I can provide citations to the documentation to support that this is the right syntax - that's trivial, however, I'd also like to point out that someone thinks this can work, here: http://www.certdepot.net/rhel7-get-started-firewalld/. I'd like to know how they managed it! Or, is this a difference between the codelines of Fedora and Centos and / or "RHEL7"?!

I'm thinking that after the failures of this codeline from Fedora 19 through to 21, it's been released WAY before its time. But, I'd be delighted to learn I'm wrong. Otherwise, I'm BACK TO IP-TABLES, and not happy about it.

  • Did you reinstall with a Minimal install? Commented Apr 19, 2015 at 0:56
  • No, I don't have another day to spend doing that. ... Other than having software I don't need on the box, does it matter?
    – Richard T
    Commented Apr 19, 2015 at 0:57
  • I wouldn't have suggested it otherwise. Commented Apr 19, 2015 at 0:58
  • ...You REALLY know that there's a good reason? If you are correct, it suggests deep incompetence somewhere. After all, why should the firewall software work / not work based on only the minimal, or the "server" set be installed? I mean, "server" implies MORE! ...I'm perplexed at your response. -heavy-sigh- I really need this behind me. What I'm concerned about is that I do this re-install and STILL have the problem when I should be configuring ip-tables instead.
    – Richard T
    Commented Apr 19, 2015 at 1:01
  • 1
    I strongly suspect that the "Server" installation customizes the firewall in some way and then locks the configuration. Might be OK for a server, but this is a router and you don't want that. Not to mention the inherent (even if minor) security risks in having unnecessary stuff installed. Commented Apr 19, 2015 at 1:02

2 Answers 2


Sorry to hear that it doesn't work for you. In my case, Fedora 22 and Centos 7, I write only the --add-forward-port, not the --add-port and it works.

Perhaps the --add-port command is what is breaking your firewall


The problem may be that firewalld depends on networkmanager for its zone information. The port forwarding is based on zones. Perhaps your server installation disables networkmananger?

More information here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .