Yrurtj

I have two network interfaces: eth0, and p2p1. My default zone is set to public. I would like to permanently set p2p1 to be trusted.

In order the achieve this I run:

sudo firewall-cmd --permanent --change-zone=p2p1 --zone=trusted

after that I get this:

The interface is under control of NetworkManager, setting zone to 'trusted'.

success

(I have netplan controlling my network.) To check if all is good I do:

sudo firewall-cmd --get-active-zones

public

  interfaces: eth0

trusted

  interfaces: p2p1

But after a reboot it is all gone. How can I make this stick?

Update: I found this "To permanently assign the eth0 network interface to the internal zone (a file called internal.xml is created in the /etc/firewalld/zones directory... "

root@me:~# nmcli con show | grep p2p1

netplan-p2p1  44db1fb7-b83f-36aa-8dd1-faa6fb97f6c4  ethernet  p2p1   

p2p1          3ad65062-db85-4ba6-9104-76644e78a5c4  ethernet  --     

p2p1          c3297794-7641-4033-9f68-156f26ffe024  ethernet  --     

root@me:~# nmcli con mod "netplan-p2p1" connection.zone trusted

root@me:~# nmcli con up "netplan-p2p1"

Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)

... the above calls changed p2p1 to zone=trusted. But same problem -- it is not sticking.

I am on an Ubuntu 18.10 system, so adding a config file like suggested here will not work. Not sure, but I am assuming I need to add some script in "/etc/network/if-up.d" folder.

Update 2: netplan config file 01-netcfg.yaml

network:

  version: 2

  renderer: NetworkManager

  ethernets:

#   WAN

    eth0:

        dhcp4: no

        dhcp6: no

        addresses: [76.80.54.221/29]

        gateway4: 76.80.54.217

        nameservers:

            addresses: [209.18.47.61,209.18.47.62]

#   LAN

    p2p1:

        dhcp4: no

        dhcp6: no     

        addresses: [192.168.1.99/24]

        gateway4: 192.168.1.100

I've found a blog post that seems related. Perhaps try to restart the firewall:

systemctl restart firewalld.service

This should be done after adding your rule and before rebooting.

Did you try reloading the firewall instead of restarting it? If not, you can do that as follows:

firewall-cmd --reload

In my experience, anytime you use the --permanent switch, you should apply that change using the --reload as stated above.

Since your interface is controlled by NetworkManager, you can manipulate the connection settings directly using nmcli to permanently set the zone:

sudo nmcli connection modify p2p1 connection.zone trusted

The default behaviour for this command is to make the changes in a persistent manner, which will survive across a reboot.

I figured it out -- finally.

I added a script file zone-for-p2p1 inside the directory /etc/network/if-up.d.

zone-for-p2p1 script file content:

#!/bin/sh

#

# sets zone for p2p1 adapter to "trusted"

# to find out adapter name run "nmcli con show | grep p2p1"

#

nmcli con mod "netplan-p2p1" connection.zone trusted

Then I also made sure the file has execution permission:

sudo chmod +x /etc/network/if-up.d/zone-for-p2p1

Now doing a reboot the script assigns the proper zone to the adapter. This post helped me add the script.