Permanently forward a port for incoming packets in the specified zone (like port 443 to 8443 when entering the `public` zone)
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4|ipv6" forward-port port="443" protocol="udp|tcp" to-port="8443"'