Hello firewalld Community,
I'm trying to understand how the to-addr feature works in firewalld. I haven’t found much information in the documentation.We use RHEL 9 and have firewalld version 1.2.1.We have an interface with a primary IP and other secondary IPs. The scenario is as follows:
ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 50:6b:8d:d8:2d:84 brd ff:ff:ff:ff:ff:ff altname enp0s3 inet 10.104.112.5/24 brd 10.104.112.255 scope global noprefixroute ens3 valid_lft forever preferred_lft forever inet 10.104.112.8/32 brd 10.104.112.255 scope global ens3 valid_lft forever preferred_lft forever
10.104.112.5 is the machine's primary IP, while 10.104.112.8 is a floating IP managed by Pacemaker.
We tried adding a rule like this:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
By doing this, we noticed that the request is always forwarded to the machine’s primary IP, i.e., 10.104.112.5.However, I expected it to be forwarded to the IP 10.104.112.9.
How is the IP to forward the request to actually decided?The only way I see to force it to 10.104.112.9 is by specifying to-addr=10.104.112.9.
In CentOS 7 with firewalld version 0.6, by specifying only the rule:
rule family="ipv4" destination address="10.104.112.9" forward-port port="80" protocol="tcp" to-port="8089"
without specifying to-addr, the request is correctly forwarded to IP 10.104.112.9.
Could anyone provide me with more information?
Thanks in advance.
Hamado Dene