I’m running a rootless podman container listening on port 8080 on OpenSUSE Tumbleweed.
From the same host, there’s no problem accessing the container. Trying to access the container remotely fails due to firewalld blocking the connection.
What I don’t understand is this:
If I configure firewalld to forward port 80 to the container on port 8080 using
firewall-cmd --add-forward-port=port=80:proto=tcp:toport=8080
I can access the container from a remote computer using port 80.
However, if I try:
firewall-cmd --add-forward-port=port=8080:proto=tcp:toport=8080
I’m not able to reach the container. It seems that every port I try will work except for port 8080 in this case, and I can’t find any references explaining why this might be the case.
What’s going on here? Is it a conflict by trying to forward a port to itself? Is there any way to allow port 8080? Trying to allow port 8080 in the public zone fails as well.
So ‘it’s already on port 8080’ makes sense, but as I mentioned, no remote computers on the same LAN can reach that port (they can ping the host with no issue), and that’s what I’m trying to resolve. I’m not using a reverse proxy.
Through further testing it looks like I’d missed adding the firewall rule to allow port 8080 TCP to the public zone; I currently have it added it to the ‘trusted’ zone which came from some online guides regarding rootlet podman but that didn’t resolve it. I’m sure I’d added it to the public zone previously as well to test with it not working so removed it, but it is now so I’ll have to keep testing a bit to ensure it’s repeatable.
If it’s losing the settings when you reboot, you can do
firewall-cmd --runtime-to-permanentwhich does what the name suggests. Alternatively, you can use the--permanentflag when adding new services.