Thank you for the answer.

I did some tests.

Bravo! Zone changes via /etc/sysconfig/network-scripts/ifcfg-<iface> (ZONE=xxx) are taken into account in a few seconds: iptables rules are appropriate.

Zone changes via "firewall-cmd --zone=xxx --change --interface=yyy"are taken into account immediately and disappear after a reboot, as you pointed.

If the zoning is done via the command "firewall-cmd --set-default-zone=xxx" (no zone declaredin /etc/sysconfig/network-scripts/ifcfg-<iface>) a restart is required. Is this the desired behavior?

Philippe.

Le 22/05/2012 08:00, Jiri Popelka a écrit :

Hi,

yes, each interface needs to be part of any zone. The zone is actually a property of the particular network connection so it should be possible to change this with the same tool where the other network connection properties are changed, i.e. the GUI to NetworkManager. But this part is still not done.

On Fedora, NetworkManager stores these settings in /etc/sysconfig/network-scripts/ifcfg-<iface> files, which is at the moment the only place where you can *permanently* change the zone of an interface. Just put for example 'ZONE=home' there. If there's no ZONE key, then default zone is used.

It's also possible to change the zone with firewall-cmd --zone=home --change --interface=em1 but that's only runtime change, so it doesn't survive restart.

Jiri

----- Original Message ----- From: "Philippe Marcovici"philippepma@free.fr To: firewalld-users@lists.fedorahosted.org Sent: Monday, May 21, 2012 6:24:14 PM Subject: How will the area change of an interface?

Hello.

I presume that a zone will be assigned to each interface. Is-it exact ?

How the change of zone will be done? Firewall-config UI ? I have not seen this possibility with the firewall-cmd command. Is-it normal ?

Thanks.

---

firewalld-users mailing list firewalld-users@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/firewalld-users _______________________________________________ firewalld-users mailing list firewalld-users@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/firewalld-users

Well done! I did not have the latest version. But, after a "yum update firewalld", it's the same.

I was with default public zone : # firewall-cmd --get-active-zones public: p2p1

I check the INPUT ZONES : # iptables -v -n -L INPUT_ZONES Chain INPUT_ZONES (1 references) pkts bytes target prot opt in out source destination 0 0 IN_ZONE_public all -- p2p1 * 0.0.0.0/0 0.0.0.0/0

I change for work defaut zone : # firewall-cmd --set-default-zone=work # firewall-cmd --get-active-zones work: p2p1

The default zone is changed, but not the iptables rules : # iptables -v -n -L INPUT_ZONES Chain INPUT_ZONES (1 references) pkts bytes target prot opt in out source destination 0 0 IN_ZONE_public all -- p2p1 * 0.0.0.0/0 0.0.0.0/0

But, after a reboot it's OK : [root@localhost ~]# firewall-cmd --get-active-zones work: p2p1

The check is OK : [root@localhost ~]# iptables -v -n -L INPUT_ZONES Chain INPUT_ZONES (1 references) pkts bytes target prot opt in out source destination 0 0 IN_ZONE_work all -- p2p1 * 0.0.0.0/0 0.0.0.0/0

Philippe.

Le 23/05/2012 16:48, Jiri Popelka a écrit :

On 05/23/2012 12:26 AM, Philippe Marcovici wrote:

...

If the zoning is done via the command "firewall-cmd --set-default-zone=xxx" (no zone declaredin /etc/sysconfig/network-scripts/ifcfg-<iface>) a restart is required. Is this the desired behavior?

In my case no restart is needed. Do you have the latest firewalld, i.e. firewalld-0.2.5 ? _______________________________________________ firewalld-users mailing list firewalld-users@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/firewalld-users

On 05/24/2012 11:30 AM, Jiri Popelka wrote:

On 05/24/2012 12:33 AM, Philippe Marcovici wrote:

...

The default zone is changed, but not the iptables rules :

You are right. Please fill a ticket at https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora

Ok, not needed. I've just fixed it http://git.fedorahosted.org/git/?p=firewalld.git;a=commitdiff;h=cbc18c7e6c75...

-- Jiri