Before I installed the F45 candidate, I configured firewalld with firewall-cmd --add-forward-port to forward external interface website traffic (80/tcp and 443/tcp) to the machine to be forewarded to my webserver via the DMZ interface. Before F45, firewalld routed traffic received as external input to the forward ports. Any traffice forwarded from other internal interfaces was routed out of the external interface.
After F45, all traffic to the forwarded ports, whether internal or external, was redirected the forward to-addr host.
Was this an intended change or was this an error change? I don’t see any git log messages that look like they are specifically intending this new behavior. It feels like it would be a mistake, but I don’t follow the specific changes in firewalld to know.
At the very least, it forced me to close off external access to only my CDN. As a work-around, I removed the basic forward-ports and added rich rules forwarding traffic from my CDN addresses to the DMZ webserver. All other external traffic to those ports is blocked.
Less likely when you are running software that is not even in beta yet.
Once it’s released there will be release notes and a lot more people using f45.
I opened a Buzilla entry for this, asking someone more knowledgable to determine if this is a behavior bug or a change in behavior requiring a documentation change.
As to the “unreleased software”, I am specifically testing the F45 release candidates to help find use-case issues.