fix(zone): the forward statement was set in the rule section

firewalld/files/zone.xml

@@ -33,9 +33,6 @@
   {%- if 'masquerade' in rule %}
     {%- if rule.masquerade %}<masquerade/>{%- endif %}
   {%- endif %}
-  {%- if 'forward' in rule %}
-    {%- if rule.forward %}<forward/>{%- endif %}
-  {%- endif %}
   {%- if 'forward_port' in rule %}
     {%- if 'comment' in rule.forward_port %}
       <!-- {{ rule.forward_port.comment }} -->
@@ -139,6 +136,9 @@
   <forward-port port="{{ v.portid }}" protocol="{{ v.protocol }}"{%- if 'to_port' in v %} to-port="{{ v.to_port }}"{%- endif %}{%- if 'to_addr' in v %} to-addr="{{ v.to_addr }}"{%- endif %} />
   {%- endfor %}
 {%- endif %}
+{%- if 'forward' in zone %}
+  {%- if rule.forward %}<forward/>{%- endif %}
+{%- endif %}
 {%- if 'source_ports' in zone %}
   {%- for v in zone.source_ports %}
     {%- if 'comment' in v %}

test/integration/default/files/_mapdata/almalinux-8.yaml

@@ -112,6 +112,7 @@ values:
         are accepted.
       other_services:
       - zabbixcustom
+      forward: true
       ports:
       - comment: zabbix-agent
         port: 10050