setting firewall-cmd --permanent is not sticking after reboot

Question

I have two network interfaces: eth0, and p2p1. My default zone is set to public. I would like to permanently set p2p1 to be trusted.

In order the achieve this I run:

sudo firewall-cmd --permanent --change-zone=p2p1 --zone=trusted

after that I get this:

The interface is under control of NetworkManager, setting zone to 'trusted'.
success

(I have netplan controlling my network.) To check if all is good I do:

sudo firewall-cmd --get-active-zones
public
  interfaces: eth0
trusted
  interfaces: p2p1

But after a reboot it is all gone. How can I make this stick?

Update: I found this "To permanently assign the eth0 network interface to the internal zone (a file called internal.xml is created in the /etc/firewalld/zones directory... "

root@me:~# nmcli con show | grep p2p1
netplan-p2p1  44db1fb7-b83f-36aa-8dd1-faa6fb97f6c4  ethernet  p2p1   
p2p1          3ad65062-db85-4ba6-9104-76644e78a5c4  ethernet  --     
p2p1          c3297794-7641-4033-9f68-156f26ffe024  ethernet  --     
root@me:~# nmcli con mod "netplan-p2p1" connection.zone trusted
root@me:~# nmcli con up "netplan-p2p1"
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)

... the above calls changed p2p1 to zone=trusted. But same problem -- it is not sticking.

I am on an Ubuntu 18.10 system, so adding a config file like suggested here will not work. Not sure, but I am assuming I need to add some script in "/etc/network/if-up.d" folder.

Update 2: netplan config file 01-netcfg.yaml

network:
  version: 2
  renderer: NetworkManager
  ethernets:
#   WAN
    eth0:
        dhcp4: no
        dhcp6: no
        addresses: [76.80.54.221/29]
        gateway4: 76.80.54.217
        nameservers:
            addresses: [209.18.47.61,209.18.47.62]
#   LAN
    p2p1:
        dhcp4: no
        dhcp6: no     
        addresses: [192.168.1.99/24]
        gateway4: 192.168.1.100

Answer 1

I figured it out -- finally.

I added a script file zone-for-p2p1 inside the directory /etc/network/if-up.d.

zone-for-p2p1 script file content:

#!/bin/sh
#
# sets zone for p2p1 adapter to "trusted"
# to find out adapter name run "nmcli con show | grep p2p1"
#
nmcli con mod "netplan-p2p1" connection.zone trusted

Then I also made sure the file has execution permission:

sudo chmod +x /etc/network/if-up.d/zone-for-p2p1

Now doing a reboot the script assigns the proper zone to the adapter. This post helped me add the script.

Answer 2

Since your interface is controlled by NetworkManager, you can manipulate the connection settings directly using nmcli to permanently set the zone:

sudo nmcli connection modify p2p1 connection.zone trusted

The default behaviour for this command is to make the changes in a persistent manner, which will survive across a reboot.

Answer 3

I've found a blog post that seems related. Perhaps try to restart the firewall:

systemctl restart firewalld.service

This should be done after adding your rule and before rebooting.

Answer 4

Did you try reloading the firewall instead of restarting it? If not, you can do that as follows:

firewall-cmd --reload

In my experience, anytime you use the --permanent switch, you should apply that change using the --reload as stated above.

Answer 5

Here is a solution for the Ubuntu 18.04 with a if-up script and firewall-cmd tool (nmcli doesn't work for some reason)

1. Become a root and create an if-up file with executive permission

   sudo su -
   touch /etc/network/if-up.d/p2p1-trusted && chmod +x $_
   

2. Put the following content and save the file

   #!/bin/sh
   
   # check if script is executed for the interface we need
   if [ "$IFACE" != "p2p1" ]; then
       exit 0
   fi
   firewall-cmd --zone=trusted --change-interface="$IFACE"
   

3. Reboot

4. Verify

   $ sudo firewall-cmd --get-active-zones
   trusted
     interfaces: p2p1
   public
     interfaces: wlp1s0
   

Answer 6

Assume X is the command (.e.g. firewall-cmd --add-service=http )

2 options :

• either X --permanent then firewall-cmd --reload

• OR run X (without permanaent) then run it again with permanent X --permanent