firewall-cmd centos port forwarding seems not to work? - centos

Question

currently I try to setup port forwarding for CentOS with firewall-cmd.
Currently my box has two interface: eth0, eth1.
eth0 represents the internal network and is in zone=public (default),
eth1 represents the external network and is in zone=external
currently eth1 is connected to another network which contains a router to the internet.
my external firewall looks like that:
external (active)
target: default
icmp-block-inversion: no
interfaces: eth1
sources: 192.168.178.0/24
services: dhcpv6-client http https ssh
ports: 1194/udp
protocols:
masquerade: yes
forward-ports: port=1194:proto=udp:toport=:toaddr=192.168.179.4
sourceports:
icmp-blocks:
rich rules:
I also had the rule for Port 22:
firewall-cmd --zone=external --add-forward-port=port=22:proto=tcp:toport=22:toaddr=192.168.179.8
However both rules don't work, neither the 1194 nor the one with port 22.
Actually I tested if Port-Forwarding from our Router works to the machine, which in fact it does because if I setup HAPROXY to point to the other SSH machine:
frontend sshd
bind 192.168.178.254:22
mode tcp
default_backend ssh
timeout client 1h
backend ssh
mode tcp
server static 192.168.179.8:22 check
and removing the port=22 rule, I can connect to it.
I actually run on a permissive selinux rule.
The public zone looks like that:
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources: 192.168.179.0/24
services: dhcpv6-client http https ssh
ports: 7583/tcp
protocols:
masquerade: no
forward-ports:
sourceports:
icmp-blocks:
rich rules:
Is there anything I'm missing?
I mean I also tried to make it work with iptables, but it didn't worked, at all.
sysctl net.ipv4.ip_forward returns net.ipv4.ip_forward = 1
The Linux Box is not the default Router for neither networks. Both have other routers in place.

Answer 1

Looks like masquerade needs to be turned on for both networks:
firewall-cmd --zone=external --permanent --add-masquerade
firewall-cmd --zone=public --permanent --add-masquerade
firewall-cmd --reload

Answer 2

zone target can be set to reject, which will block all incoming traffic except for the services and ports explicitly defined in zone config