Deactivate a FirewallD Zone

Hi,

Can anyone tell me if there is a way to deactivate a zone in firewalld? I've read through the man pages, and I can't find any option like that.

~ Bob

This article looks like it might help: https://www.linuxjournal.com/content...configurations

I don't have any personal experience with this.

Hi,

You can just make the zone inactive by removing any interfaces and sources from it.

Hi Frankbell and Tshikose,

Thank you both for attempting to answer this question. I guess there is not way to deactivate a rule without changing it. I don't like the idea of having to remove all the sources from a zone just to deactivate it. I might have a bunch of IP's listed there. I wonder why they didn't build something like that into firewalld. I would love to be able to switch the firewall configuration to temporarily block almost all traffic except for a few servers and myself while I apply an upgrade, and then switch the configuration back to the way it was.

Most of my experience is with IP tables, and I'm really not enjoying the switch to firewalld.

~ Bob

Hi Bob,

I am sorry that we couldn't provide advices that suit you.

Personnally, firewalld gives me total satisfaction. I just had once to rely on its iptables backend to solve a problem related to KVM networking.

Originally Posted by rdill Hi Frankbell and Tshikose, I would love to be able to switch the firewall configuration to temporarily block almost all traffic except for a few servers and myself while I apply an upgrade, and then switch the configuration back to the way it was.

Possible not too painful alternative ---

Add a new zone (and customize to your need):

sudo firewall-cmd --permanent --new-zone=block-almost-everything-except-myself

Assign ethernet device to the new zone and do what you gotta do:

sudo firewall-cmd --zone=block-almost-everything-except-myself --change-interface=eth1

Then return the ethernet device to previously active zone upon completion:

sudo firewall-cmd --zone=public --change-interface=eth1