How can I allow traffic from some hosts network A (behind eth0 interface) through my centos 7 box to network B (some hosts behind eth1).

network A:

network B:

Firewall interfaces:



Src Host:

Destinations: port 80/tcp and port 80/tcp

Forwarding is on and with iptables disabled I can reach the web server from

How can I realize that with firewall-cmd?


First, make sure to disable IPTABLES service as Both the FirewallD and IPTABLES service cannot co-exist at the same time.

To disable IPTABLES, execute # systemctl stop iptables

Next make sure to enable and start FirewallD service;

# systemctl start firewalld && systemctl enable firewalld

Now you need to assign each of available interfaces (in this case eth0 & eth1) to a particular network zones which are available on firewalld, by default.

Let assume; eth0 belongs to internal-zone(network-A) and eth1 belongs to public-zone(network-B). To do that;

# firewall-cmd --permanent --zone=internal --add-interface=eth0

# firewall-cmd --permanent --zone=public --add-interface=eht1

Now your firewall setup is complete. As to configure rules, for example, allow http traffic sourced from host resides in network-A you need to set rules inbound on internal-zone;

# firewall-cmd --permanent --zone=internal --add-service=http

in addition, you need to enable masquerade on public-zone as to translate IP addresses when they send to network-B

# firewall-cmd --permanent --zone=public --add-masquerade

Finally, reload the FirewallD daemon to effect the changes

# firewall-cmd --reload

To list out rules on a zone, for example on internal-zone

# firewall-cmd --zone=internal --list-all

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.