Possibly useful NetworkManager script for dynamically determined zones

Anders Blomdell anders.blomdell at control.lth.se
Thu Aug 29 15:39:55 UTC 2013


First: Thanks for a nice and firewall!

In addition to the changes to combined zone handling in
https://bugzilla.redhat.com/show_bug.cgi?id=1002016, I would like to share the
attached NetworkManager script which I have found useful.

Best regards

Anders


-- 
Anders Blomdell                  Email: anders.blomdell at control.lth.se
Department of Automatic Control
Lund University                  Phone:    +46 46 222 4625
P.O. Box 118                     Fax:      +46 46 138118
SE-221 00 Lund, Sweden


-------------- next part --------------
#!/bin/sh

if [ $# -eq 0 ] ; then
    # Convenience functionality to set firewall zone for all
    # active interfaces
    UP=$(ip addr show | grep ' UP ' | cut -d' ' -d: -f2)
    for interface in ${UP} ; do
	$0 ${interface} up
    done
    grep $0 /var/log/messages | tail
    exit
fi
(
    ZONE=
    if [ "$2" == "up" ] ; then
	for zone in /etc/firewalld/zones/* ; do
	    if [ -x $p/trigger ] ; then
		${zone}/trigger $1
		RES=$?
		if [ ${RES} -eq 0 ] ; then
		    if [ -z "${ZONE}" ] ; then
			ZONE=$(/usr/bin/basename ${zone})
		    else
			echo "$1 belongs to multiple zones"
			exit 1
		    fi
		fi
	    fi
	done
	if [ -n "${ZONE}" ] ; then
     	    echo "Moving $1 to zone ${ZONE}"
	    /usr/bin/firewall-cmd --zone "${ZONE}" --change-interface $1
	    firewall-cmd --get-active-zones
	fi
    fi
) 2>&1 | logger -t "$0"


More information about the firewalld-devel mailing list