I have a centos 7 kvm hypervisor running multiple VMs that are configured to use NAT networking.

These VMs run their services, of which ssh is the most important for administration purposes. I would like to assign ports on the hypervisor that are forwarded to the VMs using firewalld.

My hypervisor has the following interfaces:

3: wlp8s1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether 94:0c:6d:c4:b8:12 brd ff:ff:ff:ff:ff:ff
    inet brd scope global dynamic wlp8s1
       valid_lft 2627sec preferred_lft 2627sec
    inet6 2a02:a03f:268e:3e00:960c:6dff:fec4:b812/64 scope global noprefixroute dynamic
       valid_lft 345640sec preferred_lft 345640sec
    inet6 fe80::960c:6dff:fec4:b812/64 scope link
       valid_lft forever preferred_lft forever
4: virbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
    link/ether 52:54:00:64:af:d6 brd ff:ff:ff:ff:ff:ff
    inet brd scope global virbr0
       valid_lft forever preferred_lft forever

wlp8s1 is my wireless interface connected to my home network, virbr0 is kvms internal network interface.

IPV4 forwarding is enabled:

firewall-cmd --zone=external --add-forward-port=port=2022:proto=tcp:toport=22:toaddr=

I am using 2 zones: external and dmz:

  interfaces: virbr0
  interfaces: wlp8s1

One of the VMs is a database server with the following network configuration:

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 52:54:00:df:79:1e brd ff:ff:ff:ff:ff:ff
    inet brd scope global dynamic eth0
       valid_lft 2634sec preferred_lft 2634sec
    inet6 fe80::5054:ff:fedf:791e/64 scope link
       valid_lft forever preferred_lft forever

and is running sshd listening on port 22:

# systemctl status sshd
sshd.service - OpenSSH server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since Sun 2016-05-22 20:08:45 CEST; 45min ago

# ss -ntl
State       Recv-Q Send-Q              Local Address:Port                             Peer Address:Port
LISTEN      0      128                             *:22                                          *:*
LISTEN      0      128                            :::22                                         :::*

So I have tried following tutorial and the official documentation, which led me to the following chain of commands (on the hypervisor):

# firewall-cmd --zone=external --add-port=2022/tcp
# firewall-cmd --zone=external --add-forward-port=port=2022:proto=tcp:toport=22:toaddr=

but alas (from my laptop connected to my home network):

$ ssh -p 2022
ssh: connect to host port 2022: Connection refused

Things I have tested:

Tcp dumps while issueing ssh -p 2022 on my laptop:

On the hypervisor:

# tcpdump -i wlp8s1 port 2022
21:02:50.661181 IP laptop.38052 > hypervisor.down: Flags [S], seq 885834855, win 29200, options [mss 1460,sackOK,TS val 4732781 ecr 0,nop,wscale 7], length 0

On the vm, no packets are received

I can ssh from the hypervisor to the VM

If I change the firewalld forward command to:

firewall-cmd --zone=external --add-forward-port=port=2022:proto=tcp:toport=22:toaddr=

I can ssh into the hypervisor using its port 2022. Could this signify it has something to do with the zones?

Any help or extra things I could test would be greatly appreciated! Thanks!


I did find this similar question indicating firewalld was broken: Fedora 21 Port Forwarding with firewalld (firewall-cmd); how does it REALLY work? Or, does it?

but I'm hoping to find a solution here given the extra info I have hopefully provided :).


You may want to check out a few configs, Did you turn on ip forwarding in the kernel e.x. net.ipv4.ip_forward=1 => /etc/sysctl.conf ? Also you may need to run a command like this to enable masquerade: firewall-cmd --zone=external --add-masquerade .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.