I can't seem to make firewalld-based port forwarding work under Centos 7. I am forwarding to When I try to ssh to -p 905 I get "Connection refused".

Here are some relevant settings:

[root@GraceDev3 log]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: br0
  services: ssh dhcpv6-client https
  ports: 3389/tcp 905/tcp 908/tcp
  masquerade: yes
  forward-ports: port=905:proto=tcp:toport=22:toaddr=
  rich rules:

Port forwarding:

[root@GraceDev3 log]# cat /proc/sys/net/ipv4/ip_forward

tcpdump on port 22 shows the ssh request arriving. The firewalld log does not show any packets being dropped. What am I missing? I note that others have had the same problem, but I haven't found any solutions posted.

1 Answer 1


Perhaps the following is an explanation:

"NetworkManager notifies firewalld of the zone of an interface. You can assign zones to interfaces with NetworkManager, with the firewall-config tool, or the firewall-cmd command-line tool. The latter two only edit the appropriate NetworkManager configuration files. If you change the zone of the interface using firewall-cmd or firewall-config, the request is forwarded to NetworkManager and is not handled by ⁠firewalld."

The machine I'm trying to forward through is a hypervisor and I have disabled NetworkManager. That would seem to mess up the zone configuration. Will try to work around that and report back. (Or switch to iptables, which I think I understand!)

PS: I was unable to prove that the above was the source of the problem, although it does seem probable. Switching to iptables does allow the port forwarding to work. In my case, I also had a direct internet connection on the target machine (which does not allow port 22 inbound). This meant that the return packets never had their NAT corrected on the return journey. This was too complicated for me, so I switched to using ssh rather than netfilter for the forwarding and that works perfectly!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .