I'm using ansible for adding zones to my firewall on a Centos machine. Didn't realize until it (almost) too late, that I'm not getting the IN_Internal interface working, it's all going to public, which is the default defined by firewalld.conf.

This is my internal.xml

<?xml version="1.0" encoding="utf-8"?>  
  <description>For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <interface name="eth0"/>
  <service name="ipp-client"/>
  <service name="mdns"/>
  <service name="dhcpv6-client"/>
  <service name="ssh"/>  

doesn't seem like it's getting used at all.

because, for whatever reason I wind up with:

 Chain IN_internal (0 references)
      2   120 IN_public  all  --  eth0   *             [goto]

Can't see why that's what's happening there.

When I do firewall-cmd --zone=internal --change-interface=eth0 and it works (even after I reload the firewall), but it's exactly the same XML

Since I'm deploying my settings with ansible, and not running firewall-cmd on the machine, I'd like to know what firewall-cmd is doing behind the scenes so that I can push out those configs.


man 5 firewalld.zones claims that

How to set or change a zone for a connection?

The zone is stored into the ifcfg of the connection with ZONE=option. If the option is missing or empty, the default zone set in firewalld is used.

  • Thanks, I'll check that out. I grepped all of /etc/ for zone, eth0, internal, didn't see anything. I think the --permanent option isn't working in my version of centos because ifcfg-eth0 definitely doesn't have a zone in it. Guessing this would be unset if I restarted the interface. – Peter Turner Sep 9 '16 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.