I'm using a Linux computer as a gateway/firewall between the wider network and a few servers.

WAN -> [ 192.x | GATEWAY (Linux) | 10.x ]  -> [ | SERVER (Linux) ]

This configuration works fine as a gateway. Downstream nodes can hit the Internet fine, and I can port forward requests for 80 at the gateway to 8000 on the sever with firewall-cmd.

firewall-cmd --zone=external --add-forward-port=port=80:proto=tcp:toaddr=

However, once I run that command and port forwarding starts, the server ( is no longer able to reach back out to the WAN on port 80. That's a problem because it means the server can't reach any HTTP traffic on the internet.

The server can curl any Internet resource except if it's on port 80 while that forwarding rule is in place.

The gateway only has one physical NIC and it is in the external zone, which enables masquerading.

gateway:$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether dc:a6:32:1b:40:9e brd ff:ff:ff:ff:ff:ff
    inet brd scope global eth0
       valid_lft forever preferred_lft forever
    inet brd scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::dea6:32ff:fe1b:409e/64 scope link
       valid_lft forever preferred_lft forever
3: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether dc:a6:32:1b:40:9f brd ff:ff:ff:ff:ff:ff
gateway:$ ip route
default via dev eth0 onlink dev eth0 proto kernel scope link src dev eth0 proto kernel scope link src

I'm probably missing some fundamental tenant about networking that's preventing me from understanding this issue.

My assumption is that the forwarding rule makes it so all port 80 traffic (inbound or outbound) is getting mangled, when really I only want inbound traffic from 80 to get forwarded to 8000 for my server.

Is the network configuration possibly wrong? Or is there something about how I'm using firewalld that's invalid?


Maybe iptables or firewalld can be used in my scenario to port forward to specific machines on the downstream subnet, but I could not figure out how to get it working.

This may not be ideal, but my workaround was to create a systemd service on my gateway machine that uses socat to forward traffic on a specific port to a specific IP.

This is the script that gets run on my gateway to forward ports 80 and 443 to

firewall-cmd --zone=external --add-port=80/tcp
socat TCP4-LISTEN:80,fork TCP4: &
firewall-cmd --zone=external --add-port=443/tcp
socat TCP4-LISTEN:443,fork TCP4: &

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.