# Firewalld failure

**URL:** <https://forums.rockylinux.org/t/firewalld-failure/18288>\
**Category:** Rocky Linux Help & Support\
**Created:** [April 29, 2025, 10:45am UTC](https://forums.rockylinux.org/t/firewalld-failure/18288 "2025-04-29T10:45:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tmaria](https://avatars.discourse-cdn.com/v4/letter/t/4bbf92/32.png) [@tmaria](https://forums.rockylinux.org/u/tmaria)\
**Post date:** [April 29, 2025, 10:45am UTC](https://forums.rockylinux.org/t/firewalld-failure/18288/1 "2025-04-29T10:45:45Z")

</div>

Hello,

Here is my problem which I have no solution although I have tried everything. We have a public server that accepts ssh connections from public and we want to forward ssh to another internal server and at the same time if the ssh is from a specific VLAN let say 10.16.20.X/24 to accept logins locally and does not forward them.  
Tcp forwarding is working fine but login locally not. I have tried all combinations, add rich rules in external zone, adding rules to direct.xml, but nothing works.  
Any suggestions please? Should I stop firewalld and try nftables?

Thank you in advance  
M.

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [April 29, 2025, 11:35am UTC](https://forums.rockylinux.org/t/firewalld-failure/18288/2 "2025-04-29T11:35:42Z")

</div>

First, you can always check the actual ruleset that you have with:

```auto
nft list ruleset

```

For example, get ruleset, change something with FirewallD, and compare new ruleset to old to figure out how FirewallD implements your change.

* * *

A central piece of FirewallD thinking is _zone_. A zone is two things:

1. A group of other machines
2. Rules for those machines

You have now at least three groups of machines:

1. External machines on public inet
2. Internal machines inside
3. Machines on 10.16.20.0/24

You want the zone of group #1 to have a port-forward to internal server.  
You want the zone of group #3 to not have port-forward.

Create new zone for the VLAN. Maybe by copy of external?

---

<div class="post-metadata">

**Author:** ![tmaria](https://avatars.discourse-cdn.com/v4/letter/t/4bbf92/32.png) [@tmaria](https://forums.rockylinux.org/u/tmaria)\
**Post date:** [April 29, 2025, 11:59am UTC](https://forums.rockylinux.org/t/firewalld-failure/18288/3 "2025-04-29T11:59:11Z")

</div>

Thank you for your answer. Just to clarrify that the server has only one network interface which is assign to external zone. How can I create a second zone without interface?

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [April 29, 2025, 2:47pm UTC](https://forums.rockylinux.org/t/firewalld-failure/18288/4 "2025-04-29T14:47:47Z")

</div>

Zone may have _interfaces_ and _sources_. (If it has none, then it is not is use.)  
Every interface (with IP address) has to be in some zone, but zone does not _need_ interface.  
There is `--add-source` option. See `man firewall-cmd`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\
**Post date:** [June 28, 2025, 2:48pm UTC](https://forums.rockylinux.org/t/firewalld-failure/18288/5 "2025-06-28T14:48:40Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.