# Configuring firewall traffic between two interfaces

**URL:** <https://forums.rockylinux.org/t/configuring-firewall-traffic-between-two-interfaces/19050>\
**Category:** Rocky Linux Help & Support\
**Created:** [July 7, 2025, 7:20pm UTC](https://forums.rockylinux.org/t/configuring-firewall-traffic-between-two-interfaces/19050 "2025-07-07T19:20:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![apelkey](https://avatars.discourse-cdn.com/v4/letter/a/96bed5/32.png) [@apelkey](https://forums.rockylinux.org/u/apelkey)\
**Post date:** [July 7, 2025, 7:20pm UTC](https://forums.rockylinux.org/t/configuring-firewall-traffic-between-two-interfaces/19050/1 "2025-07-07T19:20:36Z")

</div>

Hey everyone!

I was looking for some clarification regarding firewalld configuration to forward/filter traffic between two interfaces on a node.

I have a node with one interface on a public network, and a second interface on a private cluster network. I saw in a previous post on these forums ([Configure firewalld for routing traffic between internal and external](https://forums.rockylinux.org/t/configure-firewalld-for-routing-traffic-between-internal-and-external/7384)) that you can use a policy with an ingress and egress zone to accomplish this.

I did a mock of this configuration on my node and have the following:

```auto
[]# firewall-cmd --policy=internal-external --list-all
internal-external (active)
  priority: -1
  target: CONTINUE
  ingress-zones: public
  egress-zones: cluster_internal
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

```

My question is, with this configuration, where do the firewalld rules/filters get applied? I.e. if I want to allow a source coming in from the public interface access to the internal cluster network, would I add that source to the public egress-zone? To the ingress-zone? Both? Let me know if I can provide any further clarification or details about the setup.

–Thanks!

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [July 7, 2025, 9:24pm UTC](https://forums.rockylinux.org/t/configuring-firewall-traffic-between-two-interfaces/19050/2 "2025-07-07T21:24:21Z")

</div>

> [@apelkey](#):
>
> My question is, with this configuration, where do the firewalld rules/filters get applied?

First, you can list current ruleset with: `sudo nft list ruleset`  
Store that output (A), make changes with firewall-cmd, store new output (B), and then compare A and B to see how your changes are implemented by FirewallD.

* * *

> [@apelkey](#):
>
> I.e. if I want to allow a source coming in from the public interface access to the internal cluster network, would I add that source to the public egress-zone?

A core concept of FirewallD is _zone_. It is both a group of machines and rules for that group.

You mention three groups of machines:

1. Members of internal cluster network
2. Members of external networks (“sources”) that you want to allow in
3. Everybody else in external networks

That is _three_ zones. (internal, outstations, public)  
You want to allow the internal to open connections to outstations and to public.  
You want to allow the outstations to open connections to internal.

The base rules of outstations are probably identical to rules for public.  
While the public zone will handle the external interface, the outstations zone will be for listed _sources_ (no interface).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\
**Post date:** [September 5, 2025, 9:24pm UTC](https://forums.rockylinux.org/t/configuring-firewall-traffic-between-two-interfaces/19050/3 "2025-09-05T21:24:38Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.