Don't bother, you are fighting against windmills. This is just one of an endless list of services that show your IP address, you will never be able to block them all.
And even if you could, the user could just run his own anywhere he wants.
Restricting outgoing IP connections would be more useful, if that doesn't disrupt your services.
No. Only the local process listening on port 2222 will receive the packet. If it replies, the reverse translation will take place, and outgoing reply packet will be out from port 22.
Fourth rule will make any encountered packets destined to port 22 to be re-routed to your local port 2222, even if they weren't meant to be for this machine. Since you don't ...
Try adding a -t nat so you select the NAT table, or maybe -t mangle. Pretty sure it will default to looking at the filter table, which won't have a PREROUTING chain. You need to specify which table you are looking at.
sh# iptables -C PREROUTING -t nat -p udp -m udp --dport 5060 -j CT --helper sip
thanks to setenforce 1 and his excellent answer here.
Firewalld configures iptables or nftables, and the resulting configuration is stateful (based on connstate status: established, related, untrack, invalid, new).
You can check the actual configuration with iptables -L -n -v and nft list ruleset.
You can choose which backend you want to use in /etc/...
No, you don't need that.
Dynamic NAT rules always use conntrack tables. So this is useless (and wrong). The nat table is traversed only by first packet of the connection, so it'll only see --ctstate NEW packets. It never sees --ctstate ESTABLISHED packets, because these don't traverse rules. If the packet is found in the connection tracker nat table, it has ...
All those answers were wrong on my fedora server. My solution was:
firewall-cmd --remove-port=8081/tcp --permanent
Please note that the command firewall-cmd --permanent --remove-port=8081/tcp was throwing an error "firewall-cmd: error: unrecognized arguments: –-remove-port=8081/tcp".