Hi, I'm struggling to set up firewalld to pass traffic between 2 networks. Is this possible with firewalld?
My lab setup is: Server (ens192:192.168.3.2) <-> (ens224:192.168.3.1) firewall (ens192:192.168.110.8) <-> (ens192:192.168.110.9) client Freshly installed CentOS 8.2 (2004), server installation with no GUI on all 3 VMs.
[root@firewall ~]# sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1
Client can ping Server [root@client ~]# ping -c 3 192.168.3.2 PING 192.168.3.2 (192.168.3.2) 56(84) bytes of data. 64 bytes from 192.168.3.2: icmp_seq=1 ttl=63 time=0.530 ms 64 bytes from 192.168.3.2: icmp_seq=2 ttl=63 time=0.552 ms 64 bytes from 192.168.3.2: icmp_seq=3 ttl=63 time=0.444 ms
Client can't get to the server's ssh port. [root@client ~]# nc 192.168.3.2 22 Ncat: No route to host.
[root@firewall ~]# systemctl stop firewalld
[root@client ~]# nc 192.168.3.2 22 SSH-2.0-OpenSSH_8.0
So far things are working as expected.
I configure firewalld as follows: [root@firewall ~]# systemctl start firewalld [root@firewall ~]# firewall-cmd --version 0.8.0 [root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens192 success [root@firewall ~]# firewall-cmd --zone=public --remove-interface=ens224 success [root@firewall ~]# firewall-cmd --zone=dmz --add-interface=ens224 success [root@firewall ~]# firewall-cmd --zone=internal --add-interface=ens192 success [root@firewall ~]# firewall-cmd --zone=internal --add-rich-rule='rule family=ipv4 source address=192.168.110.9/32 destination address=192.168.3.2/32 service name=ssh accept' success [root@firewall ~]# firewall-cmd --zone=internal --list-all internal (active) target: default icmp-block-inversion: no interfaces: ens192 sources: services: cockpit dhcpv6-client mdns samba-client ssh ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: rule family="ipv4" source address="192.168.110.9/32" destination address="192.168.3.2/32" service name="ssh" accept [root@firewall ~]# firewall-cmd --zone=dmz --list-all dmz (active) target: default icmp-block-inversion: no interfaces: ens224 sources: services: ssh ports: protocols: masquerade: no forward-ports: source-ports: icmp-blocks: rich rules:
[root@client ~]# nc 192.168.3.2 22 Ncat: No route to host.
Shouldn't this work? What am I missing?