1

I have a problem with Firewalld port forwarding. The issue is that forwarded ports are refusing connections or are not responding (TCP flag RSET? on hypervisor where port forwarding is set up)

OS: Oracle Linux 8.4, kernel 4.18

The firewalld configuration:

public (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp9s0
  sources:
  services: cockpit dhcpv6-client http https ssh
  ports: 81/tcp 55565/udp
  protocols:
  forward: no
  masquerade: yes
  forward-ports:
        port=25:proto=tcp:toport=25:toaddr=192.168.1.3
        port=143:proto=tcp:toport=143:toaddr=192.168.1.3
        port=465:proto=tcp:toport=465:toaddr=192.168.1.3
        port=587:proto=tcp:toport=587:toaddr=192.168.1.3
        port=993:proto=tcp:toport=993:toaddr=192.168.1.3
        port=3389:proto=tcp:toport=3389:toaddr=192.168.1.4
        port=3389:proto=udp:toport=3389:toaddr=192.168.1.4
  source-ports:
  icmp-blocks:
  rich rules:
        rule family="ipv6" source address="fd00::0/121" masquerade

Forwarded ports are open on target VM and its IPv4 address is correct (192.168.1.3):

PORT    STATE SERVICE
22/tcp  open  ssh
25/tcp  open  smtp
80/tcp  open  http
110/tcp open  pop3
143/tcp open  imap
443/tcp open  https
465/tcp open  smtps
587/tcp open  submission
993/tcp open  imaps
995/tcp open  pop3s

Port 80 and 443 are load balanced using Nginx (as HTTP Load Balancer) and forwarding works fine.

IPv4 and IPv6 port forwarding are enabled:

# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
# sysctl net.ipv6.conf.all.forwarding
net.ipv6.conf.all.forwarding = 1

What can be the issue here?

1 Answer 1

0

It looks strange that your zone=public. If you are using Linux as a router, then I assume that you should use zone=external for the interface connected to the internet and then "internal" or rather "dmz" for the interface connected to your webserver(s).  Using "external" will start NAT (masquerade: Yes); it should be done only for the external zone.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .