How will the area change of an interface?

Hello.

I presume that a zone will be assigned to each interface. Is-it exact ?

How the change of zone will be done? Firewall-config UI ?
I have not seen this possibility with the firewall-cmd command. Is-it 
normal ?

Thanks.

[Jiri Popelka]

Hi,

yes, each interface needs to be part of any zone.
The zone is actually a property of the particular
network connection so it should be possible to change
this with the same tool where the other network
connection properties are changed, i.e. the
GUI to NetworkManager. But this part is still
not done.

On Fedora, NetworkManager stores these settings
in /etc/sysconfig/network-scripts/ifcfg-<iface>
files, which is at the moment the only place
where you can *permanently* change the zone
of an interface.
Just put for example 'ZONE=home' there.
If there's no ZONE key, then default zone is used.

It's also possible to change the zone with
firewall-cmd --zone=home --change --interface=em1
but that's only runtime change, so it doesn't
survive restart.

Jiri

----- Original Message -----
From: "Philippe Marcovici" 
To: [e-mail]
Sent: Monday, May 21, 2012 6:24:14 PM
Subject: How will the area change of an interface?

Hello.

I presume that a zone will be assigned to each interface. Is-it exact ?

How the change of zone will be done? Firewall-config UI ?
I have not seen this possibility with the firewall-cmd command. Is-it 
normal ?

Thanks.

_______________________________________________
firewalld-users mailing list
[e-mail]
https://fedorahosted.org/mailman/listinfo/firewalld-users

Thank you for the answer.

I did some tests.

Bravo! Zone changes via /etc/sysconfig/network-scripts/ifcfg-<iface> 
(ZONE=xxx) are taken into account in a few seconds: iptables rules are 
appropriate.

Zone changes via "firewall-cmd --zone=xxx --change --interface=yyy"are 
taken into account immediately and disappear after a reboot, as you pointed.

If the zoning is done via the command "firewall-cmd 
--set-default-zone=xxx" (no zone declaredin 
/etc/sysconfig/network-scripts/ifcfg-<iface>) a restart is required. Is 
this the desired behavior?

Philippe.

Le 22/05/2012 08:00, Jiri Popelka a écrit :
> Hi,
>
> yes, each interface needs to be part of any zone.
> The zone is actually a property of the particular
> network connection so it should be possible to change
> this with the same tool where the other network
> connection properties are changed, i.e. the
> GUI to NetworkManager. But this part is still
> not done.
>
> On Fedora, NetworkManager stores these settings
> in /etc/sysconfig/network-scripts/ifcfg-<iface>
> files, which is at the moment the only place
> where you can *permanently* change the zone
> of an interface.
> Just put for example 'ZONE=home' there.
> If there's no ZONE key, then default zone is used.
>
> It's also possible to change the zone with
> firewall-cmd --zone=home --change --interface=em1
> but that's only runtime change, so it doesn't
> survive restart.
>
> Jiri
>
> ----- Original Message -----
> From: "Philippe Marcovici"
> To: [e-mail]
> Sent: Monday, May 21, 2012 6:24:14 PM
> Subject: How will the area change of an interface?
>
> Hello.
>
> I presume that a zone will be assigned to each interface. Is-it exact ?
>
> How the change of zone will be done? Firewall-config UI ?
> I have not seen this possibility with the firewall-cmd command. Is-it
> normal ?
>
> Thanks.
>
> firewalld-users mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/firewalld-users
> _______________________________________________
> firewalld-users mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/firewalld-users

[Jiri Popelka]

On 05/23/2012 12:26 AM, Philippe Marcovici wrote:
> If the zoning is done via the command "firewall-cmd 
> --set-default-zone=xxx" (no zone declaredin 
> /etc/sysconfig/network-scripts/ifcfg-<iface>) a restart is required. 
> Is this the desired behavior?

In my case no restart is needed. Do you have the latest firewalld, i.e. 
firewalld-0.2.5 ?

Well done! I did not have the latest version.
But, after a "yum update firewalld", it's the same.

I was with default public zone :
# firewall-cmd --get-active-zones
public: p2p1

I check the INPUT ZONES :
# iptables -v -n -L INPUT_ZONES
Chain INPUT_ZONES (1 references)
  pkts bytes target     prot opt in     out     source               
destination
     0     0 IN_ZONE_public  all  --  p2p1   *       
0.0.0.0/0            0.0.0.0/0

I change for work defaut zone :
# firewall-cmd --set-default-zone=work
# firewall-cmd --get-active-zones
work: p2p1

The default zone is changed, but not the iptables rules :
# iptables -v -n -L INPUT_ZONES
Chain INPUT_ZONES (1 references)
  pkts bytes target     prot opt in     out     source               
destination
     0     0 IN_ZONE_public  all  --  p2p1   *       
0.0.0.0/0            0.0.0.0/0

But, after a reboot it's OK :
[root@localhost ~]# firewall-cmd --get-active-zones
work: p2p1

The check is OK :
[root@localhost ~]# iptables -v -n -L INPUT_ZONES
Chain INPUT_ZONES (1 references)
  pkts bytes target     prot opt in     out     source               
destination
     0     0 IN_ZONE_work  all  --  p2p1   *       0.0.0.0/0            
0.0.0.0/0

Philippe.

Le 23/05/2012 16:48, Jiri Popelka a écrit :
> On 05/23/2012 12:26 AM, Philippe Marcovici wrote:
> > If the zoning is done via the command "firewall-cmd 
> > --set-default-zone=xxx" (no zone declaredin 
> > /etc/sysconfig/network-scripts/ifcfg-<iface>) a restart is required. 
> > Is this the desired behavior?
>
> In my case no restart is needed. Do you have the latest firewalld, 
> i.e. firewalld-0.2.5 ?
> _______________________________________________
> firewalld-users mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/firewalld-users

[Jiri Popelka]

On 05/24/2012 12:33 AM, Philippe Marcovici wrote:
> The default zone is changed, but not the iptables rules :

You are right. Please fill a ticket at
https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora

Thank you !

--
Jiri

[Jiri Popelka]

On 05/24/2012 11:30 AM, Jiri Popelka wrote:
> On 05/24/2012 12:33 AM, Philippe Marcovici wrote:
> > The default zone is changed, but not the iptables rules :
>
> You are right. Please fill a ticket at
> https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora

Ok, not needed. I've just fixed it
http://git.fedorahosted.org/git/?p=firewalld.git;a=commitdiff;h=cbc18c7e6c75...

--
Jiri

Great!
I would open the bugzilla.

Thank you Jiri.

Le 24/05/2012 18:41, Jiri Popelka a écrit :
> On 05/24/2012 11:30 AM, Jiri Popelka wrote:
> > On 05/24/2012 12:33 AM, Philippe Marcovici wrote:
> > > The default zone is changed, but not the iptables rules :
> >
> > You are right. Please fill a ticket at
> > https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora
>
> Ok, not needed. I've just fixed it
> http://git.fedorahosted.org/git/?p=firewalld.git;a=commitdiff;h=cbc18c7e6c75...
>
> -- 
> Jiri
> _______________________________________________
> firewalld-users mailing list
> [e-mail]
> https://fedorahosted.org/mailman/listinfo/firewalld-users