Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've just installed Fedora 19 and I'm using firewalld instead of iptables, but I'm having difficulty interpretting the new terminology.

I have 2 NICs. One is specificed ZONE="internal" and the other "external" in the ifcfg-* files, I have set ipv4.forwarding = 1 in /etc/sysctl.conf, and run firewall-cmd --zone=external --add-masquerade

However, when I attempt to route from any machine on the internal network I'm getting Destination Host Prohibited and of course if I disable firewalld the error goes away but then I lose masquerading.

In iptables there was a ruleset called FORWARD, but in firewalld I can only find --add-port-forward which isn't the same thing.

How do I allow routing in firewalld ?

... I made some progress ...

# firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i ens4 -o eth1 -j ACCEPT

Will allow routing, but its not persistent, and doesn't allow the --permanent option. How do I make this persistent accross reboots?

share|improve this question
The current version of firewall-cmd should allow you to make this a --permanent rule. – Michael Hampton Jul 5 '14 at 20:39
up vote 8 down vote accepted

Finally, I found the answer ...

# cat /etc/firewalld/direct.xml
<?xml version="1.0" encoding="utf-8"?>
   [ <rule ipv="ipv4" table="filter" chain="FORWARD_direct" priority="0"> -i eth0 -o eth1 -j ACCEPT </rule> ]

This feature appeared in firewalld-0.3.4-1.fc19 but there is no firewall-cmd support yet, and the man page was omitted, but it WORKS

Eventually found it in the following mailing list

share|improve this answer
chain="FORWARD" should be enough. As this rule is defined in direct.xml it will be transpiled as FORWARD_input – rhgb Dec 29 '15 at 1:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .