3

I have two network interfaces: eth0, and p2p1. My default zone is set to public. I would like to permanently set p2p1 to be trusted.

In order the achieve this I run:

sudo firewall-cmd --permanent --change-zone=p2p1 --zone=trusted

after that I get this:

The interface is under control of NetworkManager, setting zone to 'trusted'.
success

(I have netplan controlling my network.) To check if all is good I do:

sudo firewall-cmd --get-active-zones
public
  interfaces: eth0
trusted
  interfaces: p2p1

But after a reboot it is all gone. How can I make this stick?

Update: I found this "To permanently assign the eth0 network interface to the internal zone (a file called internal.xml is created in the /etc/firewalld/zones directory... "

root@me:~# nmcli con show | grep p2p1
netplan-p2p1  44db1fb7-b83f-36aa-8dd1-faa6fb97f6c4  ethernet  p2p1   
p2p1          3ad65062-db85-4ba6-9104-76644e78a5c4  ethernet  --     
p2p1          c3297794-7641-4033-9f68-156f26ffe024  ethernet  --     
root@me:~# nmcli con mod "netplan-p2p1" connection.zone trusted
root@me:~# nmcli con up "netplan-p2p1"
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)

... the above calls changed p2p1 to zone=trusted. But same problem -- it is not sticking.

I am on an Ubuntu 18.10 system, so adding a config file like suggested here will not work. Not sure, but I am assuming I need to add some script in "/etc/network/if-up.d" folder.

Update 2: netplan config file 01-netcfg.yaml

network:
  version: 2
  renderer: NetworkManager
  ethernets:
#   WAN
    eth0:
        dhcp4: no
        dhcp6: no
        addresses: [76.80.54.221/29]
        gateway4: 76.80.54.217
        nameservers:
            addresses: [209.18.47.61,209.18.47.62]
#   LAN
    p2p1:
        dhcp4: no
        dhcp6: no     
        addresses: [192.168.1.99/24]
        gateway4: 192.168.1.100
2

I figured it out -- finally.

I added a script file zone-for-p2p1 inside the directory /etc/network/if-up.d.

zone-for-p2p1 script file content:

#!/bin/sh
#
# sets zone for p2p1 adapter to "trusted"
# to find out adapter name run "nmcli con show | grep p2p1"
#
nmcli con mod "netplan-p2p1" connection.zone trusted

Then I also made sure the file has execution permission:

sudo chmod +x /etc/network/if-up.d/zone-for-p2p1

Now doing a reboot the script assigns the proper zone to the adapter. This post helped me add the script.

1

I've found a blog post that seems related. Perhaps try to restart the firewall:

systemctl restart firewalld.service

This should be done after adding your rule and before rebooting.

  • I tried what you suggested: "Please note, if you use –permanent switch, the rule will be activate only AFTER the firewall rules have been reloaded or firewalld.service has been restarted." -- but it is not working. – MeSo2 Jan 3 at 3:38
  • 1
    It looks like change-zone is not a command that -permanent will support based on this post. – MeSo2 Jan 3 at 3:48
1

Did you try reloading the firewall instead of restarting it? If not, you can do that as follows:

firewall-cmd --reload

In my experience, anytime you use the --permanent switch, you should apply that change using the --reload as stated above.

  • 1
    as stated above in the link to the post --permanent switch will not work with a --change-zone=p2p1 call. I tried your suggestion, but it too did not work/stick. – MeSo2 Jan 3 at 5:22
  • 1
    another source that states the same/related problem – MeSo2 Jan 3 at 5:39
1

Since your interface is controlled by NetworkManager, you can manipulate the connection settings directly using nmcli to permanently set the zone:

sudo nmcli connection modify p2p1 connection.zone trusted

The default behaviour for this command is to make the changes in a persistent manner, which will survive across a reboot.

  • I am using netplan but controlled by NetworkManager. (please see Update above.) Your suggested line did also not stick. I had to change your line to this: sudo nmcli connection modify netplan-p2p1 connection.zone trusted so it would change the zone, but it too did no stick. – MeSo2 Jan 3 at 6:37
  • @MeSo2 Then the problem isn't one of persistence. Netplan is probably overwriting all of your settings on reboot. I'm not familiar with Netplan, but let me check the documentation and see if I can come up with an alternative. – Haxiel Jan 3 at 6:49
  • That would be very much appreciated. I will add my netplan info above. – MeSo2 Jan 3 at 6:56
  • @MeSo2 So as far I understand, Netplan does not offer the functionality to directly set a parameter used by NetworkManager. Your best bet may be to file a bug report: bugs.launchpad.net/netplan – Haxiel Jan 3 at 7:36
  • Thank you for looking into Netplan. I figured it out. I needed to add a script to the /etc/network/if-up.d/ folder. Now it is working. Please Up-Vote my question and Answer - I need it. Thank you. – MeSo2 Jan 4 at 1:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.