port forwarding by address

All, So under iptables I am able to do things like: *nat -A PREROUTING -d 204.1.8.6 -j DNAT --to-destination 10.2.1.1 -A POSTROUTING -s 10.2.1.1 -j SNAT --to-source 204.1.8.6 -A PREROUTING -d 204.1.8.2 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.3.1.1 -A PREROUTING -d 204.1.8.2 -p tcp -m tcp --dport 443 -j DNAT --to-destination 10.3.1.1 -A PREROUTING -d 204.1.8.3 -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.4.1.1 -A PREROUTING -d 204.1.8.3 -p tcp -m tcp --dport 110 -j DNAT --to-destination 10.4.1.1 -A POSTROUTING -s 10.0.0.0/8 ! -d 10.0.0.0/8 -j MASQUERADE I am at a loss to figure out how to do that under firewalld. The main intention here is to have a particular incoming addr[:port] be redirected to a particular internal addr[:port] used to have VMs on an internal network (10.x.y.z). The net effect of the above entry is a specific external IP address appears to be a specific internal server, even for outgoing connections while the other internal servers get masqueraded as the primary ip. The piece I cannot seem to find is to tell firewalld-cmd to use a particular destination ip address for incoming requests and NAT that. I have tried: firewall-cmd --zone=public --remove-rich-rule='rule family="ipv4" destination address="204.1.8.6" forward-port to-addr="10.3.1.2" protocol="tcp" port="0-65535"' But that seems to ignore the destination address and instead routes everything for ALL addresses to 10.3.1.2 Is there a way with firewall-cmd to only nat traffic coming in to for a particular IP address when there are several IP addresses on the same nic? Brian Andrus ITACS/Research Computing Naval Postgraduate School Monterey, California voice: 831-656-6238