Forwarding Ports on Centos 7

Question

I'm working on a CentOS 7 server and I'm trying to get JBoss to work the way I want it too. I'm running Java 8 and JBoss(wildly) 8. I have gotten those installed and working on the default ports, but I want to get JBoss to work on port 80. I know I can get it to work on port 80 if I run it as root, but I know that isn't a good idea and I don't want to run it as root any way.

I have tried forwarding port 80 to 8080, but I haven't gotten it to work. I think I'm missing a step, but I don't know what I'm missing.

I'm using firewall-cmd. I have opened up both ports (80 & 8080) and I have enable masquerading for public zone. I have also used this command to forward the port

firewall-cmd --zone=public --add-forward-port=port=80:proto=tcp:toport=8080.  

Any idea what I'm missing?

Answer 1

I just found a way that made this possible for me:

firewall-cmd --zone=public --add-masquerade --permanent
firewall-cmd --zone=public --add-forward-port=port=443:proto=tcp:toport=3001 --permanent

Answer 2

firewall-cmd's add-forward-port will add rules to the PREROUTING NAT chain, which is only applicable for externally-generated packets. If you're trying to connect to localhost (or the server's local IP) on port 80 on the server it's going to fail because those packets never pass through PREROUTING.

If you're connecting to port 80 from an external source then the firewall-cmd you listed should work properly. I'd suggest verifying that your interface is actually in the 'public' zone.

You can also run the following command to get packet counts on the rule to make sure it is actually being hit:

iptables -t nat -vnL | grep 8080 -B1

If the packet count increments on each try, then the firewall is working properly and you have some issue beyond the firewall (perhaps an ACL on JBOSS?). If the packets don't increment on each try, the firewall rule isn't being hit at all, suggesting that you're either in the wrong zone or there is some other rule preempting the port forwarding rule.