I have one CentOS 7 kvm guest at For troubleshooting purposes, selinux is off. There is an application listening on port 9000, and port 9000/tcp is open on the firewall on the guest and the host. The default zone is the only zone in use.

On the host server (also CentOS 7), I have run the following two commands, which I thought should be enough to make this work:

# firewall-cmd --add-masquerade

# firewall-cmd --add-forward-port=port=9000:proto=tcp:toport=9000:toaddr=

The goal is for a client to request a connection to the kvm host's IP but have the connection establish with the kvm guest with the host simply passing traffic back and forth between the client and the vm.

The application itself has been ruled out as the cause of the problem, being that it works just fine if I replace the nat adapter with a bridged adapter, and I can interact with the guest on its kvm nat IP otherwise without issue. And I know a bridged adapter instead of the nat would work, but that is a last resort option. I want to keep all my vms restricted to the kvm nat if at all possible.

And finally, I need this to be done with firewalld and not iptables.

As far as I can tell, those two commands should have worked, but they didn't - I just get connection refused when trying to connect. I don't see what I've done wrong here. Am I missing a step? Did I format the command incorrectly? Or what?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.