How can I allow traffic from some hosts network A (behind eth0 interface) through my centos 7 box to network B (some hosts behind eth1).

network A:

network B:

Firewall interfaces:



Src Host:

Destinations: port 80/tcp and port 80/tcp

Forwarding is on and with iptables disabled I can reach the web server from

How can I realize that with firewall-cmd?

1 Answer 1


First, make sure to disable IPTABLES service as Both the FirewallD and IPTABLES service cannot co-exist at the same time.

To disable IPTABLES, execute # systemctl stop iptables

Next make sure to enable and start FirewallD service;

# systemctl start firewalld && systemctl enable firewalld

Now you need to assign each of available interfaces (in this case eth0 & eth1) to a particular network zones which are available on firewalld, by default.

Let assume; eth0 belongs to internal-zone(network-A) and eth1 belongs to public-zone(network-B). To do that;

# firewall-cmd --permanent --zone=internal --add-interface=eth0

# firewall-cmd --permanent --zone=public --add-interface=eht1

Now your firewall setup is complete. As to configure rules, for example, allow http traffic sourced from host resides in network-A you need to set rules inbound on internal-zone;

# firewall-cmd --permanent --zone=internal --add-service=http

in addition, you need to enable masquerade on public-zone as to translate IP addresses when they send to network-B

# firewall-cmd --permanent --zone=public --add-masquerade

Finally, reload the FirewallD daemon to effect the changes

# firewall-cmd --reload

To list out rules on a zone, for example on internal-zone

# firewall-cmd --zone=internal --list-all

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .