On 08/11/2020 10:03, Robert Smuhar wrote:

Hi, I'm struggling to set up firewalld to pass traffic between 2 networks. Is this possible with firewalld?

My lab setup is:
Server (ens192:192.168.3.2) <-> (ens224:192.168.3.1) firewall (ens192:192.168.110.8) <-> (ens192:192.168.110.9) client
Freshly installed CentOS 8.2 (2004), server installation with no GUI on all 3 VMs.

I think I understand you and I think I have much the same setup. I don't know if this is of any
help.

Server (enp1s0:192.168.122.26) <-> (virb0:192.168.122.1) firewall (wlp4s0:192.168.2.127) <-> (wlp6s0:192.168.2.116) client

firewall=meimei, client=acer, server=f33k

[root@meimei ~]# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

[root@meimei ~]# firewall-cmd --get-active-zones
libvirt
interfaces: virbr0
public
interfaces: enp2s0
trusted
interfaces: wlp4s0

[root@meimei ~]# firewall-cmd --version
0.8.4

[egreshko@acer ~]$ traceroute 192.168.122.26
traceroute to 192.168.122.26 (192.168.122.26), 30 hops max, 60 byte packets
1 192.168.2.127 (192.168.2.127) 2.735 ms 2.862 ms 3.540 ms
2 192.168.122.26 (192.168.122.26) 4.319 ms !X 4.493 ms !X 4.629 ms !X

[egreshko@acer ~]$ ping -c 2 192.168.122.26
PING 192.168.122.26 (192.168.122.26) 56(84) bytes of data.
64 bytes from 192.168.122.26: icmp_seq=1 ttl=63 time=3.26 ms
64 bytes from 192.168.122.26: icmp_seq=2 ttl=63 time=3.01 ms

[egreshko@acer ~]$ ssh 192.168.122.26
egreshko@192.168.122.26's password:
Last login: Sun Nov 8 14:04:25 2020 from 192.168.2.116

[root@meimei ~]# firewall-cmd --zone=libvirt --list-all
libvirt (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: virbr0
sources:
services: dhcp dhcpv6 dns mountd nfs nfs3 rpc-bind ssh
ports:
protocols: icmp ipv6-icmp
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule priority="32767" reject

[root@meimei ~]# firewall-cmd --zone=trusted --list-all
trusted (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: wlp4s0
sources:
services: dns kdeconnect mdns mountd nfs nfs3 rpc-bind samba-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules: