I have four interfaces in my CentOS 7.3.1611 system in three zones:

# firewall-cmd --get-active-zones
  interfaces: ens192
  interfaces: ens256 ens161
  interfaces: ens224

I want systems on the two internal zones to be able to talk to each other.

I've tried adding bidirectional direct rules:

# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -o ens256 -i ens161 -j ACCEPT
# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens256 -o ens161 -j ACCEPT

...since this is how I permitted one of the internal networks to talk to the dmz network, but A) this doesn't seem to work in the intra-zone case; and B) since this command doesn't accept the --permanent flag I have my doubts that such a command will survive a reboot.

The two internal interfaces can speak to the external (internet) zone properly.

How do I permit traffic between two interfaces in the same zone to flow?


found your question doing a google search about similar multi-interface firewall topics for firewalld. We're about a year later, and your question remains unanswered, and I am wondering if the problem you have with --permanent is related to order of arguments.

In version on Enterprise Linux 7.5, the man page on firewall-cmd clearly shows that you need to have --permanent before --direct. This is likely because any arguments after --direct are sub-arguments to direct, not the firewall-cmd. So run your command like so:

# firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -o ens256 -i ens161 -j ACCEPT

On your problem with the two Internal Interfaces... For one thing, you need to take a look at the output of # iptables -L and map out how your chains flow. The command you've put up there inserts a rule into the forward chain at the top of the chain, with priority 0. My guess is there's another chain with higher priority like "FORWARD_IN_ZONES" that ends up dropping your packets.

Also, in recent versions of firewalld you can run # firewall-cmd --set-log-denied=all in order to see info on dropped packets. The logs should include the chain name that's creating the drop.


For firewalld with nftables, a new flag --add-forward is merged two days ago [1] to allow forwarding between interfaces in a zone. It can be configured like

# firewall-cmd --zone=internal --add-forward

UPDATE 2020/09/03: a new release 0.9.0 includes that feature \o/

[1] https://github.com/firewalld/firewalld/pull/613

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.