FR: Support Firewalld adding `tailscale0` to a zone

[ananthb]

What are you trying to do?

I would like to assign a firewalld firewall zone to tailscale0 interface on Linux permanently.

How should we solve this?

Detect presence of NetworkManager and Firewalld and create a NetworkManager configuration for tailscale0 that contains a user selected zone. The zone to be used for tailscale0 could be exposed as a preference to users. Alternatively, network manager dispatcher can be used to perform this action on startup every time tailscale0 comes up.

What is the impact of not solving this?

On every boot, I manually assign tailscale0 to a zone.

Anything else?

https://wiki.archlinux.org/title/Firewalld#Using_NetworkManager_to_manage_zones

https://wiki.archlinux.org/title/NetworkManager#Network_services_with_NetworkManager_dispatcher

[danderson]

In general, we can't safely use NetworkManager in tailscale, because once we ask it to do anything to tailscale0, it wants to own the entire interface configuration, and that ends up with a fractal of bugs and different behaviors across different versions of NetworkManager.

I don't know firewalld, does it expose a DBus interface we can talk to directly, similarly to systemd-resolved? That would be tractable, and would make this work even on servers that run firewalld but not NM.

[ananthb]

Firewalld does expose a DBus interface.

[lordraiden]

If don't use firewalld or if I use ufw, do I have to change something?

[ananthb]

Tailscale creates the tailscale0 interface which can be configured using any firewall application. This issue is about automated configuration with firewalld zones. You can configure ufw for tailscale0 just like you would for any other network interface on your machine.

[lordraiden]

Tailscale creates the tailscale0 interface which can be configured using any firewall application. This issue is about automated configuration with firewalld zones. You can configure ufw for tailscale0 just like you would for any other network interface on your machine.

So regarding this for oracle linux

and this for centos 8

Is the problem and the solution the same for both?
If I am going to use routing in Centos can I apply this workaround? "firewall-cmd --permanent --add-masquerade"
or it's simply not compatible as stated above?

Both links in the documentation point to this github issue

Apparently according to the documentation RHEL doesn't have this problem https://tailscale.com/kb/1046/install-rhel-8/ this it true?

On the other hand what repo should we use with distros like almalinux? oracle, centos, RHEL?