Answer by mwfearnley for ssh port forwarding with firewall-cmd

You could try firewall-cmd --add-forward-port:

firewall-cmd --permanent --add-forward-port=port=222:proto=tcp:toaddr=172.x.x.x:toport=22firewall-cmd --reload

General syntax (https://firewalld.org/documentation/man-pages/firewall-cmd.html):

firewall-cmd [--permanent] [--zone=zone] \ --add-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]] \ [--timeout=timeval]

EDIT: this quick howto might be all you need, but as comments point out, this doesn't fix the OP's problem. Check Eduardo's comment for a possible solution if you're using libvirt.