'transparent' port forwarding connundrum

[R P Herrold]

I have been migrating older local sysadmin content, with a 
goal of 'no more iptables' ruleset manipulation.  Part of the 
load is getting outgoing email redirect into a single exit 
machine, so I can get logging (and identification of 
compromised hosts propagating virus and such )-- working.  We 
take traffic counts by originating host IP, and regularly find 
'phishing' compromised internal host sending large volumes of 
email -- the traffic counts spike up and go 'through the roof'

The standby script from long ago which I wrote is:

[herrold@centos-7 rc.d]$ cat mailfunnel.sh
#!/bin/sh
# mailfunnel.sh
NATHOST="172.168.33.2"
INSIDE="172.168.33.105"
LOCALNET="172.168.33.0/24"
LOCALHOST="127.0.0.1"
WORLD="0.0.0.0/0"
MAILPORT="25"
IPTABLES="/sbin/iptables "
# pass content initiating on 'lo'
$IPTABLES -t nat -A PREROUTING 		\
        -s $LOCALHOST -d $WORLD         \
        -j ACCEPT
$IPTABLES -t nat -A POSTROUTING         \
        -s $LOCALHOST -d $WORLD         \
        -j ACCEPT
# hand off a portforward of the backside email traffic 
#	to the logging host
$IPTABLES -t nat -A PREROUTING -p tcp  			\
        -s ! $INSIDE -d $WORLD --dport $MAILPORT        \
        -j DNAT --to-destination $INSIDE
# I suspect this rule is never hit
$IPTABLES -t nat -A POSTROUTING -p tcp                  \
        -s ! $INSIDE -d $WORLD --dport $MAILPORT        \
        -j SNAT --to $NATHOST
[herrold@centos-7 rc.d]$

looks like I've not touched the one for that site in a long 
time:

-rwxr-xr-x. 1 herrold herrold 1050 Feb  2  2005 mailfunnel.sh

This was a mixture of NAT and port forwarding


It would not harm my feelings if both the NATHOST and the 
INSIDE (mail destination) were on the same IP, and indeed that 
that destination was the gateway.  That was my first attempt, 
with trying to get 'transparent redirect' into the  gateway 
'squid' to catch even hosts not explicitly set to use the 
proxy

I had tried and failed to add to a NAT barrier host, a 
'catchall' rule to feed all port 80 traffic from the 
'backside' network over to port 3128 -- squid -- on the 
localhost, but I am missing what is wrong with this command:

[root@router squid]# firewall-cmd --zone=internal 
	--add-rule-rich='rule family="ipv4" forward-port 
	to-port="3128" to-addr="127.0.0.1" port="80"
protocol="tcp" '

usage: see firewall-cmd man page

firewall-cmd: error: unrecognized arguments: 
	--add-rule-rich=rule family="ipv4" forward-port to-port="3128" 
	to-addr="127.0.0.1" port="80" protocol="tcp" 

ehh?  that example was lifted right out of the 'man' page


What approach to convert this set of rules is most direct?  I 
suspect my answer in each case will involve reference
	firewalld.richlanguage
from its man page.  I tried to follow Example 5. I adjusted it 
to a general rule

[root@router squid]# firewall-cmd --zone=internal 
	--add-rule-rich='rule family="ipv4" forward-port to-port="25" 
	to-addr="10.16.0.1" port="25" protocol="tcp" '

usage: see firewall-cmd man page

firewall-cmd: error: unrecognized arguments: 
	--add-rule-rich=rule family="ipv4" forward-port to-port="25" 
	to-addr="10.16.0.1" port="25" protocol="tcp" 

So clearly I am missing something

Thoughts? Pointers?  (My Google-fu does not produce useful 
pointers)

-- Russ herrold