I have similar problem.

We are using:
-A PREROUTING -d 192.168.18.16/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.18.16:8080
-A PREROUTING -d 192.168.18.16/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.18.16:8443
-A OUTPUT -d 192.168.18.16/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.18.16:8080
-A OUTPUT -d 192.168.18.16/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.18.16:8443
in RHEL 6

But in RHEL 7:
  <forward-port to-port="8080" protocol="tcp" port="80"/>
  <forward-port to-port="8443" protocol="tcp" port="443"/>
generate rules only in PREROUTING chains.

OUTPUT chains are ignored.

psztoch in Comment #2

it loos as though you are trying a transparent squid redirect

This post on the mailing list may help

https://lists.fedoraproject.org/archives/list/firewalld-users@lists.fedorahosted.org/message/EBNJQXTFQDCGQAW3SJWTRSTXNO42CJOV/

I am still tinkering with it

I also have a desire to intercept all outbound port 25 TCP, as the prior email in that thread indicates

(In reply to Przemyslaw Sztoch from comment #2)
[...]
> But in RHEL 7:
>   <forward-port to-port="8080" protocol="tcp" port="80"/>
>   <forward-port to-port="8443" protocol="tcp" port="443"/>
> generate rules only in PREROUTING chains.
> 
> OUTPUT chains are ignored.

OUTPUT support is a work-in-progress, see Bug 1492722. However, currently you can use a --direct rule to add rules to the OUTPUT chain. See the firewall-cmd man page.

firewalld implements forward-ports using the iptables nat PREROUTING chain. This chain is not used for packets sent over the loopback interface as packets over the loopback should not be routed. The nat PREROUTING is used to allow conntrack.

e.g.

# iptables -v -t nat -L
...
Chain PRE_public_allow (1 references)
 pkts bytes target     prot opt in     out     source               destination
    8   480 DNAT       tcp  --  any    any     anywhere             anywhere             mark match 0x64 to::8080
...

__Solution__

However, you can get the desired affect with a --direct rule.

  # firewall-cmd --permanent --direct --add-rule ipv4 nat OUTPUT 0 -p tcp -o lo --dport 80 -j REDIRECT --to-ports 8080

---->8----

# echo -e "GET index.html HTTP/1.1" | nc localhost 80
HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/2.7.5
Date: Fri, 17 Nov 2017 15:07:39 GMT
Content-type: text/html
Content-Length: 16
Last-Modified: Fri, 17 Nov 2017 15:05:21 GMT

This is a test.

Closing as WONTFIX. See comment 6 for a simple solution. I don't think adding special rules and adding code complexity to handle the loopback interface is worth it when there is an easy alterative.