Thank you very much for your early answer!

BTW, you could improve your documentation adding the next lines to the manpage:

To add an interface to a zone and make the changes permanent, we must write the next configuration file: echo "ZONE=<zone>" >> /etc/sysconfig/network-scripts/ifcfg- <interface>

Have a nice day.

Cordialmente / Mit freundlichen Grüßen / Kind regards

Víctor R. Escobar

IBM Systems &Technology Group

Phone: +49-7031-16-2378 IBM Deutschland (Embedded image moved to file: pic47801.gif)

E-Mail: vescobar@de.ibm.com Schoenaicher Str. 220

71032 Boeblingen

Germany

IBM Deutschland Research & Development GmbH / Vorsitzender des Aufsichtsrats: Martin Jetter Geschäftsführung: Erich Baier Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294

From: Jiri Popelka jpopelka@redhat.com To: Victor Rafael Escobar Olmos/Germany/IBM@IBMDE, Cc: Thomas Woerner twoerner@redhat.com, Firewalld users discussion list firewalld-users@lists.fedorahosted.org Date: 16/08/2013 12:01 Subject: Re: Firewalld D-BUS documentation

On 08/16/2013 11:34 AM, Victor Rafael Escobar Olmos wrote:

Recently I've been reading firewalld manpages as well as many other

online

resources documented by it (fedora's wiki, etc).

When I try to browse the D-BUS interface I can't find any specific information anywhere, even if it's directly referenced from other

manpages.

For example in my local fedora installation when I type man

firewalld.dbus

it produces no results and the same for the online man pages which have broken links; example: http://linuxmanpages.net/manpages/fedora19/man5/firewalld.dbus.5.html

Is it somewhere documentation about this API or at least the real API?

There's no D-Bus interface documentation at the moment, but you can use

# gdbus introspect --system --dest org.fedoraproject.FirewallD1 --object-path /org/fedoraproject/FirewallD1

to to see interfaces and properties.

-- Jiri

You know nm-connection-editor is a GUI program, do you know if it's possible to make the same changes from the command line? (across the nmcli or another solution?).

I mean, firewalld looks to be an excellent solution which handles with many variables and situations, and I am actually surprised by the versatility to modify and manage its own configuration files from the command line interface; so this lack of interface to assign the zone for NetworkManager was a bit contrasting with the rest of the parameters to configure the firewall.

Thank you Mr. Popelka!

Cordialmente / Mit freundlichen Grüßen / Kind regards

Víctor R. Escobar

IBM Systems &Technology Group

Phone: +49-7031-16-2378 IBM Deutschland (Embedded image moved to file: pic48053.gif)

E-Mail: vescobar@de.ibm.com Schoenaicher Str. 220

71032 Boeblingen

Germany

IBM Deutschland Research & Development GmbH / Vorsitzender des Aufsichtsrats: Martin Jetter Geschäftsführung: Erich Baier Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294

From: Jiri Popelka jpopelka@redhat.com To: Firewalld users discussion list firewalld-users@lists.fedorahosted.org, Cc: Victor Rafael Escobar Olmos/Germany/IBM@IBMDE, Thomas Woerner twoerner@redhat.com Date: 16/08/2013 13:20 Subject: Re: Firewalld D-BUS documentation

On 08/16/2013 01:00 PM, Victor Rafael Escobar Olmos wrote:

BTW, you could improve your documentation adding the next lines to the manpage:

To add an interface to a zone and make the changes permanent, we must
write the next configuration file:
   echo "ZONE=<zone>" >> /etc/sysconfig/network-scripts/ifcfg-
   <interface>

Actually firewalld.zones(5) already says:

How to set or change a zone for a connection?

The zone is stored into the ifcfg of the connection with ZONE=option. If the option is missing or empty, the default zone set in firewalld is used. If the connection is controlled by NetworkManager, you can also use nm-connection-editor to change the zone.

-- Jiri

On 08/16/2013 01:36 PM, Victor Rafael Escobar Olmos wrote:

... so this lack of interface to assign the zone for NetworkManager was a bit contrasting with the rest of the parameters to configure the firewall.

Actually there is a way to achieve something similar: firewall-cmd --permanent --zone=work --add-interface=dummy0

With this you also tell firewalld to put dummy0 interface into work zone. This can be useful if NM does not know about the dummy0 interface but you still want to put that interface in some zone.

Beware that if NM knows dummy0 it tells firewalld to put that interface into zone NM wants to, so NM has always the last word (which is correct).

Example: # firewall-cmd --permanent --zone=work --add-interface=dummy0 sets dummy0 -> work on firewalld side, while

# echo "ZONE=home" >> /etc/sysconfig/network-scripts/ifcfg-dummy0 sets dummy0 -> home on NM side. Whenever then NM sets the dummy0 interface up it tells firewalld to put dummy0 into home and firewalld changes a zone dummy0 belongs to from work to home.

-- Jiri