Firewalld -- interface not adding to zone

Question

I have a peervpn interface "tap0" which I am wanting to accept all traffic from. Box is CentOS 7.

My understanding is that I just need to add the interface to the "Trusted" zone. When I try this all appears to be well but the rule does not show:

[root@ns1 ~]# ifconfig
    <abridged>
    tap0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
            inet 10.9.8.2  netmask 255.255.255.0  broadcast 10.9.8.255
            inet6 fe80::3007:81ff:fe4e:adf9  prefixlen 64  scopeid 0x20<link>
            ether 32:07:81:4e:ad:f9  txqueuelen 1000  (Ethernet)
            RX packets 43  bytes 2618 (2.5 KiB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 27  bytes 2006 (1.9 KiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    [root@ns1 ~]# firewall-cmd --zone=trusted --permanent --add-interface=tap0
    The interface is under control of NetworkManager and already bound to 'trusted'
    The interface is under control of NetworkManager, setting zone to 'trusted'.
    success
    [root@ns1 ~]# systemctl restart firewalld
    [root@ns1 ~]# firewall-cmd --zone=trusted --list-all
    trusted
      target: ACCEPT
      icmp-block-inversion: no
      interfaces:
      sources:
      services:
      ports:
      protocols:
      masquerade: no
      forward-ports:
      source-ports:
      icmp-blocks:
      rich rules:

Any advice on why this isn't working?

Answer 1

This is an issue with NetworkManager.

There are a few ways to resolve it:

Update to the latest NetworkManager package, reboot, and then add the interface to your zone with the command that you used and firewall-cmd --complete-reload and systemctl restart firewalld. (The reboot may or not be necessary but I did just in case.)

If that doesn't work, you can create/edit the xml file for your zone located at /etc/firewalld/zones/*.xml In your case, it will be trusted.xml. The syntax is:

<?xml version="1.0" encoding="utf-8"?>`
<zone>
<short>Trusted</short>
<interface name="tap0"/>
<description>Description of your choice.</description>
</zone> 

After that, firewall-cmd --complete-reload and systemctl restart firewalld and then firewall-cmd --list-all and you will see the interface in the trusted zone.

The first method worked for me but I have also confirmed that the second method works.