I would like to ask question regarding to forward-port rule for firewalld.

OS I am using is ,

CentOS Linux release 7.3.1611 (Core)

My Goal

Forward requests to httpd listening on

[root@development /]# netstat -atunp | grep httpd
tcp        0      0  *               LISTEN      2601/httpd          


I have set firewalld rule as below.

[root@development /]# firewall-cmd --list-all --zone=external
external (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  services: ssh
  masquerade: yes
  rich rules: 
    rule family="ipv4" forward-port port="8080" protocol="tcp" to-port="80"

However, if I send request from external host, firewalld rejects request to port 8080.

In this case, (client) -------> (8080)

[root@dellinspiron13z asset]# curl -XGET
curl: (7) Failed to connect to port 8080: Connection refused

If the process is running as , it works perfectly.

Is there anyway to redirect requests to localhost port?


This is how it is done:

firewall-cmd --permanent --direct --add-rule ipv4 nat OUTPUT 0 -p tcp -o lo --dport 8080 -j REDIRECT --to-ports 80

| improve this answer | |

You have to change route_localnet in sysctl on interface with address or for 'all' if you lazy

In lucky coincidence I have fresh CentOS with same version, so by default this knob is disabled

[root@tesla ~]# cat /etc/centos-release
CentOS Linux release 7.3.1611 (Core) 
[root@tesla ~]# sysctl -a | grep route_localnet
net.ipv4.conf.all.route_localnet = 0
net.ipv4.conf.default.route_localnet = 0
net.ipv4.conf.enp0s5.route_localnet = 0
net.ipv4.conf.lo.route_localnet = 0
| improve this answer | |
  • Didnt work. I think I am still missing something. – Yu Watanabe Jul 28 '17 at 0:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.