Introduction
In this lab, you will learn port forwarding.
Imagine you live at an address where you receive mail. But you move to a new room, and you want all mail sent to your old room number (Room 80) to be automatically delivered to your new room number (Room 8080). You don't want to tell everyone to update their address books; you just want the building manager to handle the redirection.
Port forwarding is part of NAT (Network Address Translation). It rewrites incoming traffic so requests that arrive on one port are redirected to another destination.
This means the firewall is doing more than simply allowing or blocking traffic. It is actively transforming packet destination information so one externally visible service entry point can lead to a different internal destination.
The Scenario:
You have a web server running on Port 8080. However, standard web browsers look for websites on Port 80. Instead of changing the web server, you will tell the firewall: "If anyone knocks on Port 80, send them directly to Port 8080."
In this lab, you will:
- Prepare the firewall for traffic handling (Masquerading).
- Create a rule to forward Port 80 to 8080.
- Test and understand the behavior of port redirection.
Enable Masquerading
In this step, before firewalld can forward ports, it needs permission to modify the network packets. This feature is called Masquerading.
Masquerading is a form of address translation. In many real deployments, it is what allows a firewall or gateway to stand in the middle and make traffic appear to come from a different address context than where it started.
Think of Masquerading as giving the firewall permission to act as a middleman, rewriting the address labels on the packets so they get to the right place.
Note: In this lab environment, we are using the trusted zone as our active zone to ensure your web terminal stays connected.
First, check which zone is currently active.
sudo firewall-cmd --get-active-zones
You will likely see trusted with your network interface (e.g., eth0).
Now, enable masquerading on this trusted zone.
sudo firewall-cmd --zone=trusted --add-masquerade
Verify that it is enabled.
sudo firewall-cmd --zone=trusted --query-masquerade
If the output is yes, you are ready to proceed.
Create Forward Rule
In this step, now comes the magic part. We will create the forwarding rule.
Forwarding rules are useful when you want stable external behavior without changing the application itself. The firewall becomes a translation layer between what clients expect and where the service actually listens.
We want to say: "For the trusted zone, take any TCP traffic aimed at port 80 and forward it to port 8080."
Run this command:
sudo firewall-cmd --zone=trusted --add-forward-port=port=80:proto=tcp:toport=8080
Let's break down the flags:
port=80: The original destination (the old room).proto=tcp: The language spoken (web traffic uses TCP).toport=8080: The new destination (the new room).
Verify the rule was added correctly.
sudo firewall-cmd --zone=trusted --list-forward-ports
You should see the rule listed in the output.
Test Forwarding
In this step, in the setup, we started a simple web server on port 8080. Let's confirm it works by visiting it directly.
curl http://127.0.0.1:8080
You should see: "Hello from Port 8080! Port Forwarding is working."
Now, let's try to test the port forwarding by accessing your own IP address on Port 80.
Find your IP address:
MY_IP=$(hostname -I | awk '{print $1}')
echo "My IP is: $MY_IP"
Try to connect to Port 80 using this IP.
curl http://$MY_IP:80
Note on Testing: In many Linux environments (including this lab), you might see a Connection refused error. This is a known limitation called NAT Loopback. The kernel often prevents a machine from connecting to its own external IP for NAT rules.
That limitation is worth remembering because it separates configuration correctness from local test behavior. Sometimes the rule is valid even when self-testing from the same machine is misleading.
In a real-world scenario, a visitor from a different computer would be successfully redirected. The fact that your list-forward-ports command in the previous step showed the rule is the real proof of success!
Remove the Rule
In this step, it is good practice to clean up after yourself. Let's remove the forwarding rule so traffic behaves normally again.
Cleaning up matters for firewall administration because stale rules can quietly change application exposure long after the original test is forgotten.
To remove a rule, you use --remove-forward-port with the exact same details you used to add it.
sudo firewall-cmd --zone=trusted --remove-forward-port=port=80:proto=tcp:toport=8080
Verify that the rule is gone.
sudo firewall-cmd --zone=trusted --list-forward-ports
The output should be empty.
Summary
In this lab, you learned how to redirect network traffic using Port Forwarding. You:
- Enabled Masquerading to let the firewall rewrite packets.
- Created a rule to forward traffic from Port 80 to Port 8080.
- Learned about NAT Loopback and why local testing can sometimes be tricky.
- Removed the rule to restore the original state.
This is a powerful technique often used to expose internal services (like databases or custom apps) on standard public ports.
