Hi, Greetings! I need some help in configuring firewalld for my Rocky Linux 9.3 setup as a router. My setup is appended below: Two NICs configured with in on zone “internal” and on zone “external”. A static route is created to which routed via on . With firewalld service running I am able t…

Hi @jlehtone Thanks for the response. With the static routing, firewalld rules and policies I am able to browse internet from all internal hosts. But unable to avail services from another private network. The data has to flow through internal nic to another gateway which is not happening.

Lets try to be more clear. There are clearly at least two subnets? I’ll call the first two “LAN” and “WAN”. Lets say the LAN is 10.0.0.0/24 and WAN is 10.20.0.0/24 for the example. Everyone, who has interface on LAN does have automatic, link-local route to 10.0.0.0/24 from interface. The Rocky …

The another router is not on the WAN, but on LAN. I have another network 10.10.0.0/24 for which the route is via 10.0.0.253 (which is same LAN, static routed). If I stop firewalld, I could avail services from the network 10.10.0.0/24 but no internet on WAN. If I start firewalld, I could avail serv…

In other words, the LAN has a second router with address 10.0.0.253 that is the gateway to SRV 10.10.0.0/24? Logically, every member of LAN has additional route: to 10.10.0.0/24 via 10.0.0.253 (that I would give them via DHCP). Since this would have nothing to do with the Rocky router, its config …

Yes. All the windows hosts in 10.0.0.0/24 has 10.0.0.254 as gateway. So traffic has path like host > 10.0.0.254 > 10.0.0.253 > 10.10.0.0/24 and back. This is working with my other similar setup. In it is Rocky Linux 9.0. As the HDD of that system is about fail I am installing latest Rocky Linux 9.…

[image] barani_pd: So traffic has path like host > 10.0.0.254 > 10.0.0.253 > 10.10.0.0/24 and back. Ok, host (10.0.0.3) creates a packet: SRC=10.0.0.3 DST=10.10.0.7 Not link-local, so it goes to 10.0.0.254. Router A has route to 10.10.0.0/24, so it forwards the SRC=10.0.0.3 DST=10.10.0.7 to…

Hi @jlehtone As said earlier, created the static routes during re-installation of Rocky Linux 9.3 and completed setup. Now my requirements are satisfied. Thanks for your support.

If I want to use a Linux box as firewall, then I’d use iptables, and remove any other firewall tools and even NetworkManager. This makes my life 10 times easier. The OP’s issue can be fixed instead of the re-installation of the OS. Based on jlehtone’s analysis, I would like to fix the asymmetrical …

[image] achen: If I want to use a Linux box as firewall, then I’d use iptables, and remove any other firewall tools and even NetworkManager. This makes my life 10 times easier. When you know what you are doing, (although with FirewallD knowing does not seem to help as much). RHEL 8 and RHEL …

Firewall Configuration

Rocky Linux Help & Support

jlehtone January 19, 2024, 11:33am 2

See RL9.3 firewalld 2 zones - #3 by jlehtone

Topic		Replies	Views
Configure firewalld for routing traffic between internal and external Rocky Linux Help & Support	2	6281	October 17, 2022
RL9.3 firewalld 2 zones Rocky Linux Help & Support rocky-linux-9	3	1255	January 8, 2024
Replacing iptables (CentOS 7) with firewalld (Rocky 9) Rocky Linux Help & Support	24	3906	July 18, 2024
RockyLinux dedicated router setup? Rocky Linux Help & Support	16	1618	April 25, 2025
Home firewall/router no internet access using firewalld networkmanager Rocky Linux Help & Support	61	938	April 5, 2026

Firewall Configuration

Related topics