Before I installed the F45 candidate, I configured firewalld with 'firewall-cmd --add-forward-port=' to forward external interface website traffic (80/tcp and 443/tcp) to the machine to be forewarded to my webserver via the DMZ interface. Before F45, firewalld routed traffic received as external input to the forward ports. Any traffic forwarded from other internal interfaces was routed out of the external interface, as I'd expect.

After F45, all traffic to the forwarded ports, whether internal or external, was redirected the forward to-addr host.

Was this an intended change or was this an error change? I don’t see any git log messages that look like they are specifically intending this new behavior. It feels like it would be a mistake, but I don’t follow the specific changes in firewalld to know.

So this is either a change that should be documented or it is a bug. I just don't know which.

At the very least, it forced me to close off external access to only my CDN. As a work-around, I removed the basic forward-ports and added rich rules forwarding traffic from my CDN addresses to the DMZ webserver. All other external traffic to those ports is blocked.

Reproducible: Always

Steps to Reproduce:
1. Install an F44 server instance with multiple NICS.
2. Configure input on the external interface with forward-ports.
3. Upgrade to F45 with 'dnf system-upgrade'
4. All traffic to the externally forwarded ports is directed to the forward host/port.
Actual Results:
All traffic, internal or external, to the external forwarded ports gets redirected to the forward host ip/port.

Expected Results:
I would expect that the forward-ports and similar settings should be processed on receiving an INPUT packet on the external interface matching the criteria.

Additional Information:
# dnf list installed \*firewalld\*
Updating and loading repositories:
Repositories loaded.
Installed packages (available for reinstall, available for upgrade)
fail2ban-firewalld.noarch        1.1.0-19.fc45 fedora
firewalld.noarch                 2.5.1-1.fc45  fedora
firewalld-filesystem.noarch      2.5.1-1.fc45  fedora

$ inxi -Fzxx
System:
  Kernel: 7.2.0-0.rc6.260807gf9a2394a2348.52.fc45.x86_64 arch: x86_64 bits: 64 compiler: gcc
    v: 16.1.1
  Console: pty pts/1 Distro: Fedora Linux 45 (Server Edition Prerelease)
Machine:
  Type: Desktop Mobo: ASUSTeK model: A8N-SLI v: 1.XX serial: <superuser required> Firmware: BIOS
    vendor: Phoenix v: ASUS A8N-SLI Revision 1014 date: 11/25/2005
CPU:
  Info: single core model: AMD Athlon 64 3500+ bits: 64 type: UP arch: K8 rev: 1 cache:
    L1: 128 KiB L2: 512 KiB
  Speed (MHz): 1000 min/max: 1000/2200 core: 1: 1000 bogomips: 4432
  Flags-basic: lm nx pae sse sse2 sse3
Graphics:
  Device-1: Advanced Micro Devices [AMD/ATI] Rage 3 [Rage XL PCI] driver: N/A arch: Rage-3
    bus-ID: 0a:08.0 chip-ID: 1002:4752
  Display: unspecified server: N/A driver: gpu: simple-framebuffer tty: 211x24
  Monitor-1: Unknown-1 size-res: N/A in console
  API: OpenGL Message: GL data unavailable in console. Try -G --display
  Info: Tools: api: glxinfo x11: xdriinfo, xdpyinfo, xprop, xrandr
Audio:
  Device-1: NVIDIA CK804 AC97 Audio vendor: ASUSTeK K8N4/A8N Series Mainboard driver: snd_intel8x0
    v: kernel bus-ID: 00:04.0 chip-ID: 10de:0059
  API: ALSA v: k7.2.0-0.rc6.260807gf9a2394a2348.52.fc45.x86_64 status: kernel-api
  Server-1: PipeWire v: 1.6.8 status: off with: 1: pipewire-pulse status: off 2: wireplumber
    status: off 3: pipewire-alsa type: plugin 4: pw-jack type: plugin
Network:
  Device-1: Aquantia AQtion AQC100 NBase-T/IEEE 802.3an Ethernet [Atlantic 10G] vendor: TRENDnet
    driver: atlantic v: kernel pcie: speed: 2.5 GT/s lanes: 4 port: N/A bus-ID: 01:00.0
    chip-ID: 1d6a:00b1 temp: 62.4 C
  IF: enp1s0 state: up speed: 10000 Mbps duplex: full mac: <filter>
  Device-2: Realtek RTL8125 2.5GbE driver: r8169 v: kernel pcie: speed: 5 GT/s lanes: 1
    port: 6000 bus-ID: 05:00.0 chip-ID: 10ec:8125
  IF: enp5s0 state: up speed: 1000 Mbps duplex: full mac: <filter>
  Device-3: Realtek RTL8125 2.5GbE driver: r8169 v: kernel pcie: speed: 5 GT/s lanes: 1
    port: 7000 bus-ID: 06:00.0 chip-ID: 10ec:8125
  IF: enp6s0 state: up speed: 1000 Mbps duplex: full mac: <filter>
  Device-4: Realtek RTL8125 2.5GbE driver: r8169 v: kernel pcie: speed: 5 GT/s lanes: 1
    port: 8000 bus-ID: 07:00.0 chip-ID: 10ec:8125
  IF: enp7s0 state: down mac: <filter>
  Device-5: Realtek RTL8125 2.5GbE driver: r8169 v: kernel pcie: speed: 5 GT/s lanes: 1
    port: 9000 bus-ID: 08:00.0 chip-ID: 10ec:8125
  IF: enp8s0 state: up speed: 2500 Mbps duplex: full mac: <filter>
Drives:
  Local Storage: total: 465.76 GiB used: 19.89 GiB (4.3%)
  ID-1: /dev/sda vendor: Maxtor model: STM3500630AS size: 465.76 GiB speed: 3.0 Gb/s
    serial: <filter>
Partition:
  ID-1: / size: 464.7 GiB used: 19.35 GiB (4.2%) fs: xfs dev: /dev/dm-0 mapped: fedora_egress-root
  ID-2: /boot size: 960 MiB used: 553.8 MiB (57.7%) fs: xfs dev: /dev/sda2
Swap:
  ID-1: swap-1 type: zram size: 1.91 GiB used: 8.7 MiB (0.4%) priority: 100 dev: /dev/zram0
Sensors:
  System Temperatures: cpu: 36.0 C mobo: 40.0 C
  Fan Speeds (rpm): cpu: 1339 case-1: 0
  Power: 12v: N/A 5v: N/A 3.3v: 3.20 vbat: N/A
Info:
  Memory: total: 2 GiB available: 1.91 GiB used: 824.8 MiB (42.2%)
  Processes: 155 Power: uptime: 21h 57m wakeups: 0 Init: systemd v: 261 default: multi-user
  Packages: pm: rpm pkgs: N/A note: see --rpm Compilers: N/A Shell: Bash v: 5.3.15
    running-in: pty pts/1 inxi: 3.3.41