I'm using a Linux computer as a gateway/firewall between the wider network and a few servers.
WAN -> [ 192.x | GATEWAY (Linux) | 10.x ] -> [ 10.0.0.100 | SERVER (Linux) ]
This configuration works fine as a gateway. Downstream nodes can hit the Internet fine, and I can port forward requests for
80 at the gateway to
8000 on the sever with
firewall-cmd --zone=external --add-forward-port=port=80:proto=tcp:toaddr=10.0.0.100:toport=8000
However, once I run that command and port forwarding starts, the server (
10.0.0.100) is no longer able to reach back out to the
WAN on port
80. That's a problem because it means the server can't reach any HTTP traffic on the internet.
The server can
curl any Internet resource except if it's on port
80 while that forwarding rule is in place.
The gateway only has one physical NIC and it is in the
external zone, which enables masquerading.
gateway:$ ip addr 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether dc:a6:32:1b:40:9e brd ff:ff:ff:ff:ff:ff inet 192.168.0.2/24 brd 192.168.0.255 scope global eth0 valid_lft forever preferred_lft forever inet 10.0.0.1/24 brd 10.0.0.255 scope global eth0 valid_lft forever preferred_lft forever inet6 fe80::dea6:32ff:fe1b:409e/64 scope link valid_lft forever preferred_lft forever 3: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether dc:a6:32:1b:40:9f brd ff:ff:ff:ff:ff:ff
gateway:$ ip route default via 192.168.0.1 dev eth0 onlink 10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.1 192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.2
I'm probably missing some fundamental tenant about networking that's preventing me from understanding this issue.
My assumption is that the forwarding rule makes it so all port 80 traffic (inbound or outbound) is getting mangled, when really I only want inbound traffic from 80 to get forwarded to 8000 for my server.
Is the network configuration possibly wrong? Or is there something about how I'm using
firewalld that's invalid?