Foomuuri feedback and some questions :)

[nekopep]

Hi there, I was looking to enable my firewall on our linux stations with a simple config file and supporting zone (because I saw the zone concept in KDE interface config).
Hopefully I found foomuuri and it is a very convenient way to configure easily and manage my firewall rules!
Now I have a wifi at work configured with "work" zone, public wifi with "public" zone and even the vpn work with zone!
So I can connect to a "public" wifi and setup vpn to work in "work" zone.
(I followed bidirectionnal laptop setup like in the wiki)

Now I have a special case. For "admin" zone, I've got two setup. Either I use a specific VPN (so I configure it with "admin" zone in kde gui) or in local mode, I run a script that setup admin interface (vlan50 and different ip mask ) as is:

sudo ip link add link eth0 name eno1.50 type vlan id 50
sudo ip addr add 192.168.50.105/24 dev eno1.50
sudo ip link set dev eno1.50 up

My currrent issue, is how could I say to foomuuri that eno1.50 must be set as "admin zone"?
(firewall-cmd --zone=admin --change-interface=eno1.50 does not work because firewalld is stopped)

I got currently this in my config:
zone {
localhost
public
work
home
admin
}

Should I set:
zone {
localhost
public
work
home
admin eno1.50 <------------------
}

In this case will it work with vpn setup? (that can be bind to tun0 or tun1 depending how many vpn I setup)

Thanks for your help!

[nekopep]

Hello,
I just did a test today, and specifying "admin eno1.50" in the zone {} parameter apply the admin zone to my manually created interface, and I can also specify zone in kde gui interface.
Don't know if normal , but looks like "admin eno1.50" is not an exclusive parameter.
So everything is good.

[nekopep]

I attach a screen capture to show how to setup firewall zone in KDE connection manager for the wiki if you want.

[kimheino]

Hi,

Thanks. It's always nice to hear that others find Foomuuri useful too.

As you already tested, your above assumptions were correct. Simply use:

zone {
  ...
  admin eno1.50
}

It defines default interfaces for zone admin, and also default zone for interface eno1.50. It's not strict: more interfaces can be added to admin (by NetworkManager / D-Bus), and eno1.50 can be moved to other zones (again by NM / D-Bus).

Apparently KDE's connection manager looks quite similar to nm-connection-editor that I'm using. Foomuuri was designed to support NetworkManager's zones (FirewallD emulation) for dynamic interface<->zone configuration.