I'm learning about iptables, firewalling, routing and so on. I'm on Linux, Centos7, and I've set up a local port forwarding to localhost with:

firewall-cmd --add-forward-port=port=2023:proto=tcp:toport=22

It is working as expected, trying from another machine. Locally, is not visible. I've tried with netstat and ss, nmap lsof and nc. Nothing, all of them "sees" everything except the 2023, even if it is currently forwarding an ssh session. After much reading, here on stackexchange I found a way to make it visible locally, (from iptables: redirect local request with NAT), but actually that is not a solution, it just made me understand why is not visible from local, but I really would like to know if exists a way to check it locally.. Or the only option is the remote connection?

Thank you :)

Edit: The set up of the test machine is easy, just execute the firewall-cmd line I wrote in this question. No other rules added. Then test it with ssh (ore nmap) from outside: works. Check it from localhost itself: both ssh and nmap gives connection refused.

Edit2: Sorry, I wrote the firewall-cmd line incorrectly with a :toaddr= at the end, fixed.

  • Can you show us the actual iptables rules that this command has set up? iptables -t filter -L -n, iptables -t nat -L -n, iptables -t mangle -L -n Commented Jun 23, 2015 at 9:21
  • ...the objective being to see if it edited the OUTPUT chains. Commented Jun 23, 2015 at 9:22
  • I've put an answer but was from the wrong pc ;) This are the right results: iptables -t filter -L -n, iptables -t nat -L -n, iptables -t mangle -L -n.
    – nnsense
    Commented Jun 23, 2015 at 13:49
  • Looks like it didn't, yet there's an intricate layout for other things. Have you consulted a manual for this firewall-cmd, does it have a provision for editing OUTPUT, whether through another switch or manually in the right place (where it won't override it)? Commented Jun 23, 2015 at 18:48

1 Answer 1


On the local machine use the IP of the interface in your test. For example if the IP is

telnet 2023
  • Exactly like all the other tools telnet sees as a local address, so it's always a "Connection refused" as with localhost or It makes perfectly sense thinking how netfilter is working. What i'm looking for is probably a tool, or an option of a tool already tried, that actually sees the forwarding as it is checking from outside. Or maybe just give up and accept is impossible to probe from localhost :D
    – nnsense
    Commented Jun 23, 2015 at 8:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .