Centos 7 OpenVPN - FirewallD keeps putting tun0 in the wrong zone on reboot

kb9mfd

I have a fresh install of Centos 7 and I have several things running on it. One of them is OpenVPN. Everything works fine, I have tun0 in the trusted zone and my nic (eno1) is public. Server is behind a router/firewall so I do not need to setup anything complicated and all traffic goes over eno1. tun0 has a masquerade to public (eno1). VPN Clients work fine. If I reboot, FirewallD puts the tun0 interface in the public zone instead of the trusted zone although I used the --permanent option. This causes the entire network stack to fail for some reason and the only way I can get back in to make the change is over the local console. How do I get FirewallD to keep the tun0 interface in trusted over a reboot? Is there a script or a way to trigger a script when OpenVPN creates the tun0 interface so I can tell FirewallD to put it in the correct zone? Thanks!

openvpn_inc

kb9mfd wroteIf I reboot, FirewallD puts the tun0 interface in the public zone instead of the trusted zone although I used the --permanent option. This causes the entire network stack to fail for some reason and the only way I can get back in to make the change is over the local console. How do I get FirewallD to keep the tun0 interface in trusted over a reboot? Is there a script or a way to trigger a script when OpenVPN creates the tun0 interface so I can tell FirewallD to put it in the correct zone?

See --up or perhaps --route-up in the manual. But perhaps a better fix is to consult firewalld(8) documentation and see if it has a configuration file to store such things. Or even better, convert to static firewall rules! There is no checking in iptables(8) nor iptables-restore(8) for existence of an interface name. Your rules can refer to tun0 or even tun+ (the wildcard in iptables) before any such interface exists.

hth, regards, rob0

kb9mfd

openvpn_inc wrote
kb9mfd wroteIf I reboot, FirewallD puts the tun0 interface in the public zone instead of the trusted zone although I used the --permanent option. This causes the entire network stack to fail for some reason and the only way I can get back in to make the change is over the local console. How do I get FirewallD to keep the tun0 interface in trusted over a reboot? Is there a script or a way to trigger a script when OpenVPN creates the tun0 interface so I can tell FirewallD to put it in the correct zone?
See --up or perhaps --route-up in the manual. But perhaps a better fix is to consult firewalld(8) documentation and see if it has a configuration file to store such things. Or even better, convert to static firewall rules! There is no checking in iptables(8) nor iptables-restore(8) for existence of an interface name. Your rules can refer to tun0 or even tun+ (the wildcard in iptables) before any such interface exists.

hth, regards, rob0

Thank you for the great suggestion with --up, I will try that. What I learned is the zone is in the ifcfg-* files but since those are not used for tun0 so I can't set it there. But I found that NetworkManager sets up the rule in /etc/NetworkManager/system-connections but I discovered it keeps the rules in a file 'tun0-{UUID}', but at every reboot the UUID changes and that is why its not being persistent, I see a file for each time I have rebooted. Unless there is a way to make openvpn force the same UUID for tun0 each time I will probably just have to use a script with --up. Thanks!