- Posted In
- Red Hat Enterprise Linux
Firewalld Adding Interfaces to a Zone Issue
as always, thanks for helping with my issues.
I have been studying firewalld lately, here is an issue i have not been able to figure out.
- All interfaces by default are added to the default zone. In my case, the "public" zone is default.
- I have three interfaces ens32 ens33 and ens34, all assigned to the public zone.
- I removed ens34 from public zone
' firewal-cmd --permanent --zone=public --remove-interface=ens34'
- Now I add ens34 to the "internal' zone
' firewall-cmd --permanent --zone=internal --add-interface=ens34'
5 . Each time i reboot the server or i restart firewalld, ens34 gets assigned back to the "public " zone.
What I am doing wrong here?
The zone is controlled by the
ZONE=optionparameter in the
ifcfgfiles in the
firewalld.zonesman page says: If the option is missing or empty, the default zone set in firewalld is used.
The parameters you used are only for interfaces for which no
For NetworkManager controlled interfaces, the easiest way to (permanently) change the zone is to use the
Thanks Robert. If you are not a server with no GUI, does nm-connection-editor tool work?
It would have been nice for firewall-cmd to assign interfaces permanently to zones. Though.
Thanks for your reply.
As James pointed out, you can also use
nmtui. For example, to change a zone with
nmcli, you would call:
nmclihas a very handy auto-completion available, so you can just go on pressing Tab, and it will offer available commands and subcommands.
nmcli auto completion doesn't work when running a basic server. nmcli auto completion only works in graphics mode. That is something I have been wondering myself. However, all the information you guys have provided has put my mind at peace.
Just install the
bash-completionpackage for auto-completion to work. (The shell needs to be restarted for this to take effect.)
You my friend you are awesome. Thanks a bunch.
If you are logged in from a system with an X Server and have $DISPLAY set, you can still use nm-connection-editor (and other GUI tools). The most obvious example would be running 'ssh -X' from a desktop or laptop with a full Linux GUI running.
If you need a text-only console option, both "nmtui" and "nmcli" should allow you to set or change most or all of the options that are controlled by "nm-connection-editor".
Thanks James for all the input.
After some searching I found this has been reported before:
Bug 1112742 - firewall-cmd --permanent --change-interface=... should report an error
Man pages were updated recently firewalld bug fix and enhancement update
/etc/sysconfig/network-scripts/ifcfg-eth0method has worked before, and still works most of the time, during a
firewall-cmd --reloadthose might get ignored!
Therefore, it is advisable to use
firewall-cmdand the firewalld-richlanguage to add/change interfaces to specific zones. This will write a record to
/etc/firewalld/zones/public.xml, for example. The following would be the cmdline:
It's equally important to note that the default zone gets ignored when using this method, and needs to be explicitly specified. This last point might need to be corroborated, though.
I confirmed this behavior on CentOS 7.2.1511 and CentOS 7.3.1611.
Issue is being tracked here: https://github.com/t-woerner/firewalld/issues/195
Similar behaviour was found in RHEL 7.3. (ZONE being blanked in ifcfg on reboot. )And was treated as Bug 1381314. Currently the fix is available in latest package of firealld JFYI