I'm working on a CentOS 7 server and I'm trying to get JBoss to work the way I want it too. I'm running Java 8 and JBoss(wildly) 8. I have gotten those installed and working on the default ports, but I want to get JBoss to work on port 80. I know I can get it to work on port 80 if I run it as root, but I know that isn't a good idea and I don't want to run it as root any way.

I have tried forwarding port 80 to 8080, but I haven't gotten it to work. I think I'm missing a step, but I don't know what I'm missing.

I'm using firewall-cmd. I have opened up both ports (80 & 8080) and I have enable masquerading for public zone. I have also used this command to forward the port

firewall-cmd --zone=public --add-forward-port=port=80:proto=tcp:toport=8080.  

Any idea what I'm missing?

  • What's wrong with running httpd or nginx in front of it? Dec 22, 2014 at 12:05
  • Nothing, I was trying to not do it that way if I could help it.
    – zzzsys
    Dec 22, 2014 at 16:08

2 Answers 2


I just found a way that made this possible for me:

firewall-cmd --zone=public --add-masquerade --permanent
firewall-cmd --zone=public --add-forward-port=port=443:proto=tcp:toport=3001 --permanent
  • 1
    correct +1 for you. I had to do lot of struggle to get here.
    – Guru
    Feb 6, 2017 at 16:15
  • FirewallD is not running May 18, 2019 at 5:36
  • @SteveYakovenko then starting it is a good first step.
    – just_user
    May 20, 2019 at 8:12

firewall-cmd's add-forward-port will add rules to the PREROUTING NAT chain, which is only applicable for externally-generated packets. If you're trying to connect to localhost (or the server's local IP) on port 80 on the server it's going to fail because those packets never pass through PREROUTING.

If you're connecting to port 80 from an external source then the firewall-cmd you listed should work properly. I'd suggest verifying that your interface is actually in the 'public' zone.

You can also run the following command to get packet counts on the rule to make sure it is actually being hit:

iptables -t nat -vnL | grep 8080 -B1

If the packet count increments on each try, then the firewall is working properly and you have some issue beyond the firewall (perhaps an ACL on JBOSS?). If the packets don't increment on each try, the firewall rule isn't being hit at all, suggesting that you're either in the wrong zone or there is some other rule preempting the port forwarding rule.

  • Thank you, I will check that out. The connection is from an external source.
    – zzzsys
    Dec 22, 2014 at 16:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .