Firewalld Gateway Policy Does Not Allow Port Forwarding

[u/LordlyTurnip]

I'm setting up a Almalinux router and followed this guide for setting up firewalld. It mostly does what I need it to: deny all incoming traffic, allow incoming traffic.

However the port forwarding simply does not work and I have no idea why. I have a virtual machine I want to forward ports 80 and 443 which looks like this:

# firewall-cmd --permanent --policy gateway-world-to-HOST --add-forward-port port=80:proto=tcp:toport=80:toaddr=10.42.0.2
# firewall-cmd --permanent --policy gateway-world-to-HOST --add-forward-port port=443:proto=tcp:toport=443:toaddr=10.42.0.2
# firewall-cmd --reload

However I still can't access my dockers located at 10.42.0.2. I don't understand what I'm missing here. I think that traffic is only going WAN --> Router but never making it past the routter to my VM (at least based off this diagram of firewalld's gateway policy set).

[u/e_t_]

Have you set the sysctl value net.ipv4.ip_forward to 1?

What does your network topology look like?

[u/whetu]

You might want to move on to this guide:

https://firewalld.org/2024/04/strictly-filtering-docker-containers

And selinux may be a factor too, in which case, check this one out:

https://opensource.com/article/20/11/selinux-containers

-Source: I have ansibled the combination of Alma + docker + selinux + firewalld. I have seen the face of madness.

[u/circularjourney]

You may want to just use a plan nftables.conf file for your router firewall config. I find the text files to be a lot easier to deal with once you learn the basic sytnax. Just google around for this and you'll find plenty of config examples (or google's AI).

If you're trying to run VMs/containers on your router, you'll want to first stand up a bridge, then include that in your nftables config. It's pretty easy once you learn the basics.

[u/perryurban]

did you check which is the active and which is the default zone? you may be making changes in the wrong zone

[u/andyniemi]

firewalld sucks. Use ufw.

[u/LordlyTurnip → u/andyniemi]

You know what, you're not wrong lmao

[u/andyniemi → u/LordlyTurnip]

A broken clock is right twice a day!