I'm trying to forward a port to an external IP using firewall-cmd, but I need to deny access from certain ips.

To setup a port-forward of port 55500, I use:

firewall-cmd --permanent --zone=public --add-forward-port=port=55500:proto=tcp:toport=55500:toaddr=

Which works fine, and users connecting to port 55500 are successfully redirected to , but, as mentioned previously, I need to deny access to users coming from, for that I tried:

firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='' reject"

or :

firewall-cmd --permanent --zone=public --add-rich-rule='rule family=ipv4 source address= port port=55500 protocol=tcp reject'


firewall-cmd --zone=drop --add-source=

But none of the commands above (all followed by firewall-cmd --reload) worked, and users connecting to port 55500 from still get redirected to

How can I deny the port redirection based on the source IP?


It didn't work before because I missed --permanent.
The following command denies any port redirection from users coming from

firewall-cmd --zone=drop --permanent --add-source=
firewall-cmd --reload

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.