title: firewall-cmd centos port forwarding seems not to work?
body: <p>currently I try to setup port forwarding for CentOS with firewall-cmd.</p>
  
  <p>Currently my box has two interface: eth0, eth1.</p>
  
  <p>eth0 represents the internal network and is in zone=public (default),</p>
  
  <p>eth1 represents the external network and is in zone=external</p>
  
  <p>currently eth1 is connected to another network which contains a router to the internet.</p>
  
  <p>my external firewall looks like that:</p>
  
  <pre><code>external (active)
    target: default
    icmp-block-inversion: no
    interfaces: eth1
    sources: 192.168.178.0/24
    services: dhcpv6-client http https ssh
    ports: 1194/udp
    protocols: 
    masquerade: yes
    forward-ports: port=1194:proto=udp:toport=:toaddr=192.168.179.4
    sourceports: 
    icmp-blocks: 
    rich rules: 
  </code></pre>
  
  <p>I also had the rule for Port 22:</p>
  
  <pre><code>firewall-cmd --zone=external --add-forward-port=port=22:proto=tcp:toport=22:toaddr=192.168.179.8
  </code></pre>
  
  <p>However both rules don't work, neither the 1194 nor the one with port 22.
  Actually I tested if Port-Forwarding from our Router works to the machine, which in fact it does because if I setup HAPROXY to point to the other SSH machine:</p>
  
  <pre><code>frontend sshd
      bind 192.168.178.254:22
      mode tcp
      default_backend ssh
      timeout client 1h
  
  backend ssh
      mode tcp
      server static 192.168.179.8:22 check
  </code></pre>
  
  <p>and removing the <code>port=22</code> rule, I can connect to it.
  I actually run on a permissive selinux rule.</p>
  
  <p>The public zone looks like that:</p>
  
  <pre><code>public (active)
    target: default
    icmp-block-inversion: no
    interfaces: eth0
    sources: 192.168.179.0/24
    services: dhcpv6-client http https ssh
    ports: 7583/tcp
    protocols: 
    masquerade: no
    forward-ports: 
    sourceports: 
    icmp-blocks: 
    rich rules: 
  </code></pre>
  
  <p>Is there anything I'm missing?
  I mean I also tried to make it work with iptables, but it didn't worked, at all.</p>
  
  <p><code>sysctl net.ipv4.ip_forward</code> returns <code>net.ipv4.ip_forward = 1</code></p>
  
  <p>The Linux Box is not the default Router for neither networks. Both have other routers in place.</p>