Redirect web server from port 5000 to port 80 on localhost (Fedora, firewall-cmd)

On Fedora 24, a web server (Node.js) is running (standalone, no apache/nginx) on port 5000. http://localhost:5000 works How to make it accessible on port 80? Tried this systemctl restart firewalld firewall-cmd --add-service=http --permanent firewall-cmd --add-masquerade --permanent firewall-cmd --add-forward-port=port=80:proto=tcp:toport=5000 firewall-cmd --list-all FedoraWorkstation (active) target: default icmp-block-inversion: no interfaces: wlp3s0 sources: services: mdns ssh dhcpv6-client samba-client https http ports: 1025-65535/tcp 1025-65535/udp protocols: masquerade: yes forward-ports: port=80:proto=tcp:toport=5000:toaddr= source-ports: icmp-blocks: rich rules: **Additional info** Tried all the above with --zone=external too Running node as root on port 80 works. Note, there's no IPv4: netstat -tpln Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/systemd tcp 0 0 0.0.0.0:4433 0.0.0.0:* LISTEN 3977/deluge-gtk tcp 0 0 0.0.0.0:51157 0.0.0.0:* LISTEN 3977/deluge-gtk tcp 0 0 0.0.0.0:5432 0.0.0.0:* LISTEN 900/postgres tcp 0 0 0.0.0.0:17500 0.0.0.0:* LISTEN 3203/dropbox tcp 0 0 127.0.0.1:17600 0.0.0.0:* LISTEN 3203/dropbox tcp 0 0 127.0.0.1:17603 0.0.0.0:* LISTEN 3203/dropbox tcp6 0 0 :::111 :::* LISTEN 1/systemd tcp6 0 0 :::4433 :::* LISTEN 3977/deluge-gtk tcp6 0 0 :::51157 :::* LISTEN 3977/deluge-gtk tcp6 0 0 :::5432 :::* LISTEN 900/postgres tcp6 0 0 :::17500 :::* LISTEN 3203/dropbox tcp6 0 0 :::34017 :::* LISTEN 10532/code tcp6 0 0 :::5858 :::* LISTEN 30394/node tcp6 0 0 :::5000 :::* LISTEN 30394/node