Port forwarding to VM using firewalld

I have been looking and not able to find anything about how to solve this problem. I am trying to set up port forwarding to a VM (qemu) on a CentOS 7 Server.

Tying to forward anything incoming on 8050 to 192.168.100.50:8080.
Tried firewall-config, and been searching all over the web for several days.

I can not find anyone who has been able to solve it without just going back to iptables.

Host OS:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether f0:4d:a2:09:c9:87 brd ff:ff:ff:ff:ff:ff
    inet XXX.XXX.49.99/29 brd XXX.XXX.49.103 scope global em1
       valid_lft forever preferred_lft forever
    inet6 :::f24d:a2ff:fe09:c987/64 scope link
       valid_lft forever preferred_lft forever
6: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN
    link/ether 52:54:00:b8:57:fb brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
       valid_lft forever preferred_lft forever
7: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast master virbr0 state DOWN qlen 500
    link/ether 52:54:00:b8:57:fb brd ff:ff:ff:ff:ff:ff
21: virbr1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
    link/ether 52:54:00:35:6f:b2 brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.1/24 brd 192.168.100.255 scope global virbr1
       valid_lft forever preferred_lft forever
22: virbr1-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast master virbr1 state DOWN qlen 500
    link/ether 52:54:00:35:6f:b2 brd ff:ff:ff:ff:ff:ff
34: vnet1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master virbr1 state UNKNOWN qlen 500
    link/ether fe:54:00:32:25:24 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::fc54:ff:fe32:2524/64 scope link
       valid_lft forever preferred_lft forever
35: vnet0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master virbr1 state UNKNOWN qlen 500
    link/ether fe:54:00:6c:bf:44 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::fc54:ff:fe6c:bf44/64 scope link
       valid_lft forever preferred_lft forever

VM:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 52:54:00:6c:bf:44 brd ff:ff:ff:ff:ff:ff
    inet 192.168.100.50/24 brd 192.168.100.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fe6c:bf44/64 scope link
       valid_lft forever preferred_lft forever

xzero121

Posted 2015-05-09T17:03:21.570

Reputation: 11

What hypervisor are you using? Qemu/KVM, Virtualbox, etc. Sounds like you are using a routed/nated vs a bridged network adapter setup. – David – 2015-05-09T17:06:53.437

qemu (using virt-manager so there isn't a quick way to switch from nat to bridged) but won't changing to bridged mean I need another external IP? – xzero121 – 2015-05-09T17:11:20.723

Please post your ifconfig (or ip address show) for both your guest and your vm host. – David – 2015-05-09T17:18:14.343

I added those to the original post – xzero121 – 2015-05-09T17:24:47.443

@xzero121 You write "won't changing to bridged mean I need another external IP?" <-- It's not clear to me what you mean by 'external ip' but maybe if it is bridged then the VM gets an IP from the router as if it's another computer on your network, so if your network is 192.168.x.y then the VM will be too. So it's still behind your real router's NAT , it is still a/that private IP range, but the hypervisor isn't doing its own NAT. – barlop – 2015-05-10T13:53:18.313

The host OS has an external IP, it is internet facing, no NAT. it is handles NAT for the VM. – xzero121 – 2015-05-10T22:14:53.210

I was hoping to figure out how to do this with firewalld, but it looks like this might be the only option. – xzero121 – 2015-05-11T11:47:42.940

Redirecting to /bin/systemctl status iptables.service iptables.service Loaded: masked (/dev/null) Active: inactive (dead)

May 05 16:33:33 virtHost systemd[1]: Stopped IPv4 firewall with iptables. – xzero121 – 2015-05-11T14:07:43.600

Port forwarding to VM using firewalld

Answers