QA:Testcase firewalld and NetworkManager

Description

This is the test case to check if firewalld and NetworkManager are working together.

How to test

1. Connect to a network and check if the network is part of the default zone:

 firewall-cmd --list=all --zone=public

The output should look like this ('em1' is in used as an example):

 zone: public
 interfaces: em1
 services: dhcpv6-client, ssh

To see the zone of active devices:

 nmcli -f NAME,DEVICES,ZONE con status

The output should look like this:

 NAME                      DEVICES    ZONE
 System em1                em1        not set

'not set' means to use the default zone.

You can also check the resulting firewall directly:

 iptables-save | grep ZONES

The result should be something like this:

 :POSTROUTING_ZONES - [0:0]
 :PREROUTING_ZONES - [0:0]
 -A PREROUTING -j PREROUTING_ZONES
 -A POSTROUTING -j POSTROUTING_ZONES
 :PREROUTING_ZONES - [0:0]
 -A PREROUTING -j PREROUTING_ZONES
 :FORWARD_ZONES - [0:0]
 :INPUT_ZONES - [0:0]
 -A INPUT -j INPUT_ZONES
 -A FORWARD -j FORWARD_ZONES
 -A FORWARD_ZONES -i em1 -j FWDI_ZONE_public
 -A FORWARD_ZONES -o em1 -j FWDO_ZONE_public
 -A INPUT_ZONES -i em1 -j IN_ZONE_public

'em1' is the interface used by NetworkManager for the connection. NM will automatically add the interface of a connection to the default zone.

2. Change the zone of a connection.

Add ZONE=work to the ifcfg file of the connection.

As root use an editor and add "ZONE=work" to the end of the ifcfg file of that connection. The result should look like this:

 UUID="......................"
 NM_CONTROLLED="yes"
 BOOTPROTO="dhcp"
 DEVICE="em1"
 ONBOOT=yes
 HWADDR=.........
 TYPE=Ethernet
 DEFROUTE=yes
 PEERDNS=yes
 PEERROUTES=yes
 IPV4_FAILURE_FATAL=yes
 IPV6INIT=no
 NAME="System em1":
 ZONE=work

NetworkManager will automatically reconnect and the zone will be set accordingly:

 firewall-cmd --list=all --zone=work

The output should look like this:

 zone: work
 interfaces: em1
 services: ipp-client, dhcpv6-client, ssh

3. Remove the ZONE from the ifcfg file again and the interface will be placed into the default zone 'public'.

4. Set a new default zone in the firewalld config file as root with an editor:

The result will look like this:

 # default zone
 # The default zone used if an empty zone string is used.
 # Default: public
 DefaultZone=home

Reload firewalld:

 firewall-cmd --reload

Reinitiate the connection in NetworkManager and check if the conneciton is using the new default zone:

 firewall-cmd --list=all --zone=home

You can also set the default zone with 'firewalld-cmd --set-default-zone=zone', but at the moment there is a SELinux problem with this - it forbids firewalld to write in it's own configuration directory. This will be fixed.