after more tests, it appears that the zone is partialy applied:

$  nmcli -f NAME,DEVICES,ZONE con status
NOM                       PÉRIPHÉRIQUES ZONE          
WIFI                   wlp3s0     home          
VPN                   wlp3s0     work

but

$ firewall-cmd --get-active-zones
home
  interfaces: wlp3s0

when port 9000 is open in zone work only, telnet on port 9000 from the other side of the vpn answers "no route to host"

when port 9000 is open in zone home only, telnet on port 9000 from the other side of the vpn answers "no route to host"

when port 9000 is open in zone public (which is the default zone) only, telnet on port 9000 from the other side of the vpn is ok

as if VPN was in fact in default zone…

_______________________________________________
firewalld-users mailing list
firewalld-users@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/firewalld-users