firewalld port forwarding breaks outbound traffic on that port

Question

I'm using a Linux computer as a gateway/firewall between the wider network and a few servers.

WAN -> [ 192.x | GATEWAY (Linux) | 10.x ]  -> [ 10.0.0.100 | SERVER (Linux) ]

This configuration works fine as a gateway. Downstream nodes can hit the Internet fine, and I can port forward requests for 80 at the gateway to 8000 on the sever with firewall-cmd.

firewall-cmd --zone=external --add-forward-port=port=80:proto=tcp:toaddr=10.0.0.100:toport=8000

However, once I run that command and port forwarding starts, the server (10.0.0.100) is no longer able to reach back out to the WAN on port 80. That's a problem because it means the server can't reach any HTTP traffic on the internet.

The server can curl any Internet resource except if it's on port 80 while that forwarding rule is in place.

The gateway only has one physical NIC and it is in the external zone, which enables masquerading.

gateway:$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether dc:a6:32:1b:40:9e brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.2/24 brd 192.168.0.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet 10.0.0.1/24 brd 10.0.0.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::dea6:32ff:fe1b:409e/64 scope link
       valid_lft forever preferred_lft forever
3: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether dc:a6:32:1b:40:9f brd ff:ff:ff:ff:ff:ff

gateway:$ ip route
default via 192.168.0.1 dev eth0 onlink
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.1
192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.2

I'm probably missing some fundamental tenant about networking that's preventing me from understanding this issue.

My assumption is that the forwarding rule makes it so all port 80 traffic (inbound or outbound) is getting mangled, when really I only want inbound traffic from 80 to get forwarded to 8000 for my server.

Is the network configuration possibly wrong? Or is there something about how I'm using firewalld that's invalid?

Answer 1

Maybe iptables or firewalld can be used in my scenario to port forward to specific machines on the downstream subnet, but I could not figure out how to get it working.

This may not be ideal, but my workaround was to create a systemd service on my gateway machine that uses socat to forward traffic on a specific port to a specific IP.

This is the script that gets run on my gateway to forward ports 80 and 443 to 10.0.0.100.

firewall-cmd --zone=external --add-port=80/tcp
socat TCP4-LISTEN:80,fork TCP4:10.0.0.100:80 &
firewall-cmd --zone=external --add-port=443/tcp
socat TCP4-LISTEN:443,fork TCP4:10.0.0.100:443 &
wait