I'm running openvpn on CentOS 7 with firewalld. I've enabled masquerading on the public (default) zone, and it works fine. However, I occasionally need to run services on localhost/127.0.0.1, and the masquerading is messing that up. The services properly bind to 127.0.0.1, but the client code which tries to connect to it seems to be mapping the destination IP address of 127.0.0.1 to the IP address for eth0, where the server is not listening (it was configured for 127.0.0.1 only).
How do I limit the masquerading to only a specific subnet so openvpn still works, but I can also access services locally on localhost without masquerading interfering?
Another way to word my question: How do I prevent masquerading of the loopback address(es)?
Some ideas I've had, but can't figure out how to do (or do without breaking something else):
- Limit masquerading to only 10.8.0.0/16 for openvpn
- Limit masquerading by moving the IP address for eth0 to another zone
- Tolerate masquerading by moving the loopback interface to the trusted zone, and adding the IP address for eth0 as a source in the trusted zone