2

I can't seem to make firewalld-based port forwarding work under Centos 7. I am forwarding 192.168.0.148:905 to 192.168.56.102:22. When I try to ssh to 192.168.0.148 -p 905 I get "Connection refused".

Here are some relevant settings:

[root@GraceDev3 log]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: br0
  sources:
  services: ssh dhcpv6-client https
  ports: 3389/tcp 905/tcp 908/tcp
  protocols:
  masquerade: yes
  forward-ports: port=905:proto=tcp:toport=22:toaddr=192.168.56.102
        port=908:proto=tcp:toport=22:toaddr=192.168.56.105
  source-ports:
  icmp-blocks:
  rich rules:

Port forwarding:

[root@GraceDev3 log]# cat /proc/sys/net/ipv4/ip_forward
1

tcpdump on 192.168.0.148 port 22 shows the ssh request arriving. The firewalld log does not show any packets being dropped. What am I missing? I note that others have had the same problem, but I haven't found any solutions posted.

1 Answer 1

0

Perhaps the following is an explanation:

"NetworkManager notifies firewalld of the zone of an interface. You can assign zones to interfaces with NetworkManager, with the firewall-config tool, or the firewall-cmd command-line tool. The latter two only edit the appropriate NetworkManager configuration files. If you change the zone of the interface using firewall-cmd or firewall-config, the request is forwarded to NetworkManager and is not handled by ⁠firewalld."

The machine I'm trying to forward through is a hypervisor and I have disabled NetworkManager. That would seem to mess up the zone configuration. Will try to work around that and report back. (Or switch to iptables, which I think I understand!)

PS: I was unable to prove that the above was the source of the problem, although it does seem probable. Switching to iptables does allow the port forwarding to work. In my case, I also had a direct internet connection on the target machine (which does not allow port 22 inbound). This meant that the return packets never had their NAT corrected on the return journey. This was too complicated for me, so I switched to using ssh rather than netfilter for the forwarding and that works perfectly!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .