HI,
me and firewalld won't have a good start, but I hope we'll be good friends.
One of my hosts must rerote traffic from one to another host. It isn't a big problem.
I've a host witch must do:
1) forwarding port 25 tcp to a second host Here I've a special mail-relay. My external.xml look like this one: <?xml version="1.0" encoding="utf-8"?> <zone> <short>External</short> <description>For use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description> <interface name="eth1"/> <service name="ssh"/> <masquerade/> <forward-port to-addr="10.0.0.87" protocol="tcp" port="25"/> </zone>
Every thing works expected, incomming traffic on port 25 is forwarded to 10.0.0.87 port 25.
2) traffic from 80.80.80.80 and destination-port 25 should be forwarded to port 22 tcp on 10.0.0.17 and not to 10.0.0.87 on port 25
So I made a new rule with: firewall-cmd --zone=external --add-rich-rule='rule forward-port port="25" to-port="22" to-addr="10.0.0.17" protocol="tcp" family="ipv4" source address="80.80.80.80"'
If I try to connect on host 80.80.80.80 my system with: "telnet 10.0.0.17 25" I can connect the final host 10.0.0.17 on port 22 and open-ssh will greet me "SSH-2.0-oPENssh_6.6.1". It is working like I've expected.
If I made my new firewall-rule permanent I use: "firewall-cmd --runtime-to-permanent" an the zone-file has now this content: <?xml version="1.0" encoding="utf-8"?> <zone> <short>External</short> <description>For use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description> <interface name="eth1"/> <service name="ssh"/> <masquerade/> <forward-port to-addr="10.0.0.87" protocol="tcp" port="25"/> <rule family="ipv4"> <source address="80.80.80.80"/> <forward-port to-addr="10.0.0.17" to-port="22" protocol="tcp" port="25"/> </rule> </zone>
O.K. That isn't a miracle. BUT, every is working right till I restart the server or reload the firewalld with: "firewall-cmd --reload"
Now I can't access my host 10.0.0.17 via ssh over my transit-host! I'll reach destination-host 10.0.0.87 on port 25. It looks like, my rich rule were'nt definied. :/
Any idea, how to make it reboot-save?
Thanx for help
ttyl, Django