I have a centos 7 kvm hypervisor running multiple VMs that are configured to use NAT networking.

These VMs run their services, of which ssh is the most important for administration purposes. I would like to assign ports on the hypervisor that are forwarded to the VMs using firewalld.

My hypervisor has the following interfaces:

3: wlp8s1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 94:0c:6d:c4:b8:12 brd ff:ff:ff:ff:ff:ff
    inet brd scope global dynamic wlp8s1
       valid_lft 2627sec preferred_lft 2627sec
    inet6 2a02:a03f:268e:3e00:960c:6dff:fec4:b812/64 scope global noprefixroute dynamic
       valid_lft 345640sec preferred_lft 345640sec
    inet6 fe80::960c:6dff:fec4:b812/64 scope link
       valid_lft forever preferred_lft forever
4: virbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
    link/ether 52:54:00:64:af:d6 brd ff:ff:ff:ff:ff:ff
    inet brd scope global virbr0
       valid_lft forever preferred_lft forever

wlp8s1 is my wireless interface connected to my home network, virbr0 is kvms internal network interface.

IPV4 forwarding is enabled:

firewall-cmd --zone=external --add-forward-port=port=2022:proto=tcp:toport=22:toaddr=

I am using 2 zones: external and dmz:

  interfaces: virbr0
  interfaces: wlp8s1

One of the VMs is a database server with the following network configuration:

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 52:54:00:df:79:1e brd ff:ff:ff:ff:ff:ff
    inet brd scope global dynamic eth0
       valid_lft 2634sec preferred_lft 2634sec
    inet6 fe80::5054:ff:fedf:791e/64 scope link
       valid_lft forever preferred_lft forever

and is running sshd listening on port 22:

# systemctl status sshd
sshd.service - OpenSSH server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since Sun 2016-05-22 20:08:45 CEST; 45min ago

# ss -ntl
State       Recv-Q Send-Q              Local Address:Port                             Peer Address:Port
LISTEN      0      128                             *:22                                          *:*
LISTEN      0      128                            :::22                                         :::*

So I have tried following tutorial and the official documentation, which led me to the following chain of commands (on the hypervisor):

# firewall-cmd --zone=external --add-port=2022/tcp
# firewall-cmd --zone=external --add-forward-port=port=2022:proto=tcp:toport=22:toaddr=

but alas (from my laptop connected to my home network):

$ ssh -p 2022
ssh: connect to host port 2022: Connection refused

Things I have tested:

Tcp dumps while issueing ssh -p 2022 on my laptop:

On the hypervisor:

# tcpdump -i wlp8s1 port 2022
21:02:50.661181 IP laptop.38052 > hypervisor.down: Flags [S], seq 885834855, win 29200, options [mss 1460,sackOK,TS val 4732781 ecr 0,nop,wscale 7], length 0

On the vm, no packets are received

I can ssh from the hypervisor to the VM

If I change the firewalld forward command to:

firewall-cmd --zone=external --add-forward-port=port=2022:proto=tcp:toport=22:toaddr=

I can ssh into the hypervisor using its port 2022. Could this signify it has something to do with the zones?

Any help or extra things I could test would be greatly appreciated! Thanks!


I did find this similar question indicating firewalld was broken: Fedora 21 Port Forwarding with firewalld (firewall-cmd); how does it REALLY work? Or, does it?

but I'm hoping to find a solution here given the extra info I have hopefully provided :).

1 Answer 1


You may want to check out a few configs. Did you turn on ip forwarding in the kernel e.x. net.ipv4.ip_forward=1 => /etc/sysctl.conf?

Also you may need to run a command like this to enable masquerade:

firewall-cmd --zone=external --add-masquerade

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .