I have four interfaces in my CentOS 7.3.1611 system in three zones:
# firewall-cmd --get-active-zones dmz interfaces: ens192 internal interfaces: ens256 ens161 external interfaces: ens224
I want systems on the two internal zones to be able to talk to each other.
I've tried adding bidirectional direct rules:
# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -o ens256 -i ens161 -j ACCEPT # firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens256 -o ens161 -j ACCEPT
...since this is how I permitted one of the internal networks to talk to the dmz network, but A) this doesn't seem to work in the intra-zone case; and B) since this command doesn't accept the
--permanent flag I have my doubts that such a command will survive a reboot.
The two internal interfaces can speak to the external (internet) zone properly.
How do I permit traffic between two interfaces in the same zone to flow?