Fedora's ability to forward ports using the apparently "native" networking software, firewalld, appears to continue to be broken beyond credulity. Please note that it hasn't really worked since at least Fedora 19 (see https://serverfault.com/questions/541087/fc19-firewalld-debugging-help-requested-ports-not-forwarding)
Note that it can't even "permanently" put an interface into a given zone in the current (21) release (with all updates through to this date) - a fundamental capability for this software, to be sure, as evidenced here, https://serverfault.com/questions/683783/fedora-21-firewalld-firewall-cmd-wont-permanently-assign-interfaces-to-zones/683792#683792.
As suggested by the "accepted answer" under this question,
IP tables is still in use "under the sheets" with firewalld (firewall-cmd). I have had NO SUCCESS whatsoever with getting firewalld (firewall-cmd) to successfully do any port forwarding - not that I've tried everything possible, but I've tried a lot - and it makes me wonder if it's even possible.
Somehow, some way, we need to know if we should even BOTHER with this codeline. WHY ON EARTH should we spend DAYS of our time, individually (and collectively many man-years) if the codeline is so inept?! Maybe the authors should Pull The Code until it's READY for prime-time? MAYBE someone should say, "No, use ip-tables until we fix this thing, quit wasting your time, sorry!"
What I can tell you DOES NOT WORK is a most basic example:
Take the forwarding of a port of obscurity, say, 9876, from an external interface to port 22, the SSH port, to a particular internal system. So, on a newly installed system, after sorting out the IP addresses of the interfaces, assigning them permanently to their respective zones (see https://serverfault.com/questions/683783/fedora-21-firewalld-firewall-cmd-wont-permanently-assign-interfaces-to-zones/683792#683792), the forwarding is then assigned. First, the port is "opened" and then "forwarded" using something like this:
firewall-cmd --zone=external --add-port=9876/tcp firewall-cmd --zone=external --add-forward-port=port=9876:proto=tcp:toport=22:toaddr=192.168.1.1
The problem is, this does NOT work. (The result is a simple timeout, nothing found in the logs.) I can provide citations to the documentation to support that this is the right syntax - that's trivial, however, I'd also like to point out that someone thinks this can work, here: http://www.certdepot.net/rhel7-get-started-firewalld/. I'd like to know how they managed it! Or, is this a difference between the codelines of Fedora and Centos and / or "RHEL7"?!
I'm thinking that after the failures of this codeline from Fedora 19 through to 21, it's been released WAY before its time. But, I'd be delighted to learn I'm wrong. Otherwise, I'm BACK TO IP-TABLES, and not happy about it.