firewalld doesn't allow outgoing connections

My (really) old firewall died and I decided to replace it with Ubuntu 22.04 as I have moved to it on my other servers as well.

I have two NICs, one (en2ps0 X.X.X.X, zone public) for outer world and another (en3ps0 192.168.200.1, zone dmz) for DMZ computers. I got traffic working from outside to my open https services without problems. I also can use any internet services on my firewall but all traffic from DMZ to the internet is blocked.

I have perused net hours but haven't got any idea what the problem could be.

On the public zone I have allowed forwarding and masquerading (and as said port forwardiong to DMZ internal servers works just fine).

On DMZ the forwarding is on, but no masquerading needed(?).

I have tried to allow the traffic out from DMZ with the following command: firewall-cmd --permanent --direct --add-rule ipv4 filter OUPUT 1 -o en3ps0 -j ACCEPT

DMZ computers are on the same internal subnet with fw dmz zone 192.168.200.0/24 and have 192.168.200.1 as the gateway.

Can anyone help me, I am already desperate...

wbr

H

After a lot of head-banging I managed to get it working.

I followed the instructions to set up a policy from this page: https://forums.rockylinux.org/t/firewalld-networkmanager-internet-routing-not-working-in-rocky-linux-9-x/7280/12

My commands were:

firewall-cmd --set-default-zone=public --permanent
firewall-cmd --reload
firewall-cmd --new-policy dmz-public --permanent
firewall-cmd --reload
firewall-cmd --policy dmz-public --add-ingress-zone=dmz --permanent
firewall-cmd --policy dmz-public --add-egress-zone=public --permanent
firewall-cmd --policy dmz-public --set-target=ACCEPT --permanent
firewall-cmd --reload
firewall-cmd --info-policy dmz-public
```