I have two network interfaces: eth0, and p2p1. My default zone is set to public. I would like to permanently set p2p1 to be trusted.

In order the achieve this I run:

sudo firewall-cmd --permanent --change-zone=p2p1 --zone=trusted

after that I get this:

The interface is under control of NetworkManager, setting zone to 'trusted'.

(I have netplan controlling my network.) To check if all is good I do:

sudo firewall-cmd --get-active-zones
  interfaces: eth0
  interfaces: p2p1

But after a reboot it is all gone. How can I make this stick?

Update: I found this "To permanently assign the eth0 network interface to the internal zone (a file called internal.xml is created in the /etc/firewalld/zones directory... "

root@me:~# nmcli con show | grep p2p1
netplan-p2p1  44db1fb7-b83f-36aa-8dd1-faa6fb97f6c4  ethernet  p2p1   
p2p1          3ad65062-db85-4ba6-9104-76644e78a5c4  ethernet  --     
p2p1          c3297794-7641-4033-9f68-156f26ffe024  ethernet  --     
root@me:~# nmcli con mod "netplan-p2p1" connection.zone trusted
root@me:~# nmcli con up "netplan-p2p1"
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)

... the above calls changed p2p1 to zone=trusted. But same problem -- it is not sticking.

I am on an Ubuntu 18.10 system, so adding a config file like suggested here will not work. Not sure, but I am assuming I need to add some script in "/etc/network/if-up.d" folder.

Update 2: netplan config file 01-netcfg.yaml

  version: 2
  renderer: NetworkManager
#   WAN
        dhcp4: no
        dhcp6: no
        addresses: []
            addresses: [,]
#   LAN
        dhcp4: no
        dhcp6: no     
        addresses: []

6 Answers 6


I figured it out -- finally.

I added a script file zone-for-p2p1 inside the directory /etc/network/if-up.d.

zone-for-p2p1 script file content:

# sets zone for p2p1 adapter to "trusted"
# to find out adapter name run "nmcli con show | grep p2p1"
nmcli con mod "netplan-p2p1" connection.zone trusted

Then I also made sure the file has execution permission:

sudo chmod +x /etc/network/if-up.d/zone-for-p2p1

Now doing a reboot the script assigns the proper zone to the adapter. This post helped me add the script.


Since your interface is controlled by NetworkManager, you can manipulate the connection settings directly using nmcli to permanently set the zone:

sudo nmcli connection modify p2p1 connection.zone trusted

The default behaviour for this command is to make the changes in a persistent manner, which will survive across a reboot.

  • I am using netplan but controlled by NetworkManager. (please see Update above.) Your suggested line did also not stick. I had to change your line to this: sudo nmcli connection modify netplan-p2p1 connection.zone trusted so it would change the zone, but it too did no stick.
    – MeSo2
    Commented Jan 3, 2019 at 6:37
  • @MeSo2 Then the problem isn't one of persistence. Netplan is probably overwriting all of your settings on reboot. I'm not familiar with Netplan, but let me check the documentation and see if I can come up with an alternative.
    – Haxiel
    Commented Jan 3, 2019 at 6:49
  • That would be very much appreciated. I will add my netplan info above.
    – MeSo2
    Commented Jan 3, 2019 at 6:56
  • @MeSo2 So as far I understand, Netplan does not offer the functionality to directly set a parameter used by NetworkManager. Your best bet may be to file a bug report: bugs.launchpad.net/netplan
    – Haxiel
    Commented Jan 3, 2019 at 7:36
  • Thank you for looking into Netplan. I figured it out. I needed to add a script to the /etc/network/if-up.d/ folder. Now it is working. Please Up-Vote my question and Answer - I need it. Thank you.
    – MeSo2
    Commented Jan 4, 2019 at 1:40

I've found a blog post that seems related. Perhaps try to restart the firewall:

systemctl restart firewalld.service

This should be done after adding your rule and before rebooting.

  • I tried what you suggested: "Please note, if you use –permanent switch, the rule will be activate only AFTER the firewall rules have been reloaded or firewalld.service has been restarted." -- but it is not working.
    – MeSo2
    Commented Jan 3, 2019 at 3:38
  • 1
    It looks like change-zone is not a command that -permanent will support based on this post.
    – MeSo2
    Commented Jan 3, 2019 at 3:48

Did you try reloading the firewall instead of restarting it? If not, you can do that as follows:

firewall-cmd --reload

In my experience, anytime you use the --permanent switch, you should apply that change using the --reload as stated above.

  • 1
    as stated above in the link to the post --permanent switch will not work with a --change-zone=p2p1 call. I tried your suggestion, but it too did not work/stick.
    – MeSo2
    Commented Jan 3, 2019 at 5:22
  • 1
    another source that states the same/related problem
    – MeSo2
    Commented Jan 3, 2019 at 5:39

Here is a solution for the Ubuntu 18.04 with a if-up script and firewall-cmd tool (nmcli doesn't work for some reason)

  1. Become a root and create an if-up file with executive permission

    sudo su -
    touch /etc/network/if-up.d/p2p1-trusted && chmod +x $_
  2. Put the following content and save the file

    # check if script is executed for the interface we need
    if [ "$IFACE" != "p2p1" ]; then
        exit 0
    firewall-cmd --zone=trusted --change-interface="$IFACE"
  3. Reboot

  4. Verify

    $ sudo firewall-cmd --get-active-zones
      interfaces: p2p1
      interfaces: wlp1s0

Assume X is the command (.e.g. firewall-cmd --add-service=http )

2 options :

  • either X --permanent then firewall-cmd --reload

  • OR run X (without permanaent) then run it again with permanent X --permanent

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .