Proper way to change zones?

[Patrick]

Hello!

I am trying to make use of firewalld now that I am in F17, but
documentation is slim :).

I have created a zone xml file in /usr/local/lib/firewalld/zones/ and
added some services to /usr/local/lib/firewalld/services/ . I have
then linked them to the appropriate folders in /etc/firewalld.

Even after reloading firewalld, it does not list my new zone when I
issue the command firewall-cmd --get-zones. I have set my interface to
use my new zone in the appropriate /etc/sysconfig/network-scripts
file. Now when I issue firewall-cmd --get-zone-of-interface=eth0 I get
no output, instead of "public," which was the zone it used to receive
by default.

If I issue "nmcli -f NAME,DEVICES,ZONE con status" it lists my new
zone, so I guess that is something :).

Am I doing this all wrong?! Thank you for any assistance,

Patrick

[Thomas Woerner]

On 03/30/2012 10:50 PM, Patrick wrote:
>  Hello!
>
>  I am trying to make use of firewalld now that I am in F17, but
>  documentation is slim :).
>
>  I have created a zone xml file in /usr/local/lib/firewalld/zones/ and
>  added some services to /usr/local/lib/firewalld/services/ . I have
>  then linked them to the appropriate folders in /etc/firewalld.
>
>  Even after reloading firewalld, it does not list my new zone when I
>  issue the command firewall-cmd --get-zones. I have set my interface to
>  use my new zone in the appropriate /etc/sysconfig/network-scripts
>  file. Now when I issue firewall-cmd --get-zone-of-interface=eth0 I get
>  no output, instead of "public," which was the zone it used to receive
>  by default.
>
>  If I issue "nmcli -f NAME,DEVICES,ZONE con status" it lists my new
>  zone, so I guess that is something :).
>
>  Am I doing this all wrong?! Thank you for any assistance,
>  
Please have a look at /var/log/firewalld if there is an error about the 
zone file you have added.

If there is an error about the zone, please post additionally to the 
zone file.

If there is no error, please enable the debug mode of firewalld by 
adding --debug at the line ExecStart line in 
/usr/lib/systemd/system/firewalld.service:
   ExecStart=/usr/sbin/firewalld --nofork --debug

firewalld will then write additional debug log information to 
/var/log/firewalld

There should be a message about the zone file in the log, now.

>  Patrick
>  _______________________________________________
>  firewalld-users mailing list
>  firewalld-users(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/firewalld-users 
Thanks,
Thomas

[Patrick]

Hello, thank you for the reply!

I "fixed" it by copying the xml file directly to the proper folder in
/etc/firewalld instead of symbolically linking it. The original file
was in  /usr/local/lib/firewalld/services/ and all root:root 644. I
don't know enough about permissions to speculate why it wouldn't work
like that, but that is the same permissions the new file has in
/etc/firewalld and it is happy with it now!

Patrick

On Wed, Apr 4, 2012 at 09:20, Thomas Woerner <twoerner(a)redhat.com&gt; wrote:
>  On 03/30/2012 10:50 PM, Patrick wrote:
> >
> > Hello!
> >
> > I am trying to make use of firewalld now that I am in F17, but
> > documentation is slim :).
> >
> > I have created a zone xml file in /usr/local/lib/firewalld/zones/ and
> > added some services to /usr/local/lib/firewalld/services/ . I have
> > then linked them to the appropriate folders in /etc/firewalld.
> >
> > Even after reloading firewalld, it does not list my new zone when I
> > issue the command firewall-cmd --get-zones. I have set my interface to
> > use my new zone in the appropriate /etc/sysconfig/network-scripts
> > file. Now when I issue firewall-cmd --get-zone-of-interface=eth0 I get
> > no output, instead of "public," which was the zone it used to receive
> > by default.
> >
> > If I issue "nmcli -f NAME,DEVICES,ZONE con status" it lists my new
> > zone, so I guess that is something :).
> >
> > Am I doing this all wrong?! Thank you for any assistance,
> >
>  Please have a look at /var/log/firewalld if there is an error about the zone
>  file you have added.
>
>  If there is an error about the zone, please post additionally to the zone
>  file.
>
>  If there is no error, please enable the debug mode of firewalld by adding
>  --debug at the line ExecStart line in
>  /usr/lib/systemd/system/firewalld.service:
>   ExecStart=/usr/sbin/firewalld --nofork --debug
>
>  firewalld will then write additional debug log information to
>  /var/log/firewalld
>
>  There should be a message about the zone file in the log, now.
>
> > Patrick
> > _______________________________________________
> > firewalld-users mailing list
> > firewalld-users(a)lists.fedorahosted.org
> > https://fedorahosted.org/mailman/listinfo/firewalld-users
>
>
>  Thanks,
>  Thomas
>  _______________________________________________
>  firewalld-users mailing list
>  firewalld-users(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/firewalld-users

[Thomas Woerner]

Hello Patrick,

On 04/04/2012 10:33 PM, Patrick wrote:
>  Hello, thank you for the reply!
>
>  I "fixed" it by copying the xml file directly to the proper folder in
>  /etc/firewalld instead of symbolically linking it. The original file
>  was in  /usr/local/lib/firewalld/services/ and all root:root 644. I
>  don't know enough about permissions to speculate why it wouldn't work
>  like that, but that is the same permissions the new file has in
>  /etc/firewalld and it is happy with it now!
>  
this was most likely a SELinux limitation. Files outside of 
/etc/firewalld do not have proper SELinux contexts.

>  Patrick
>  
Thomas