Hi:
Some of this is tech I used to know and understand before grey matter began taking over on me.
My first question:
Home Network, going through my own Router, to a Cable Modem/Router.
What would be the preferred zone for my NIC (eth0)? And, why?
I currently have this:
StudioAsus01:~ # firewall-cmd --get-active-zones
docker
interfaces: docker0
internal
interfaces: eth0
Do I need/want the docker interface: docker0?
Do I want the eth0 interface to be in the internal zone? Or, would it be better in the home zone?
Next, the following: Does firewall-cmd just automatically use the public zone unless told otherwise?
StudioAsus01:~ # firewall-cmd --list-all
You're performing an operation over default zone ('public'),
but your connections/interfaces are in zone 'docker,internal' (see --get-active-zones)
You most likely need to use --zone=docker option.
public
target: default
icmp-block-inversion: no
interfaces:
sources:
services: dhcpv6-client
ports:
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
Checking docker, I get this:
StudioAsus01:~ # firewall-cmd --zone=docker --list-all
docker (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: docker0
sources:
services:
ports:
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
Is that what I want? Or, not?
Checking internal, I get:
StudioAsus01:~ # firewall-cmd --zone=internal --list-all
internal (active)
target: default
icmp-block-inversion: no
interfaces: eth0
sources:
services: mdns ssh tigervnc tigervnc-https vnc-server
ports:
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
That all looks okay to me, but do I want internal or another zone, such as home or work?
Or, do you see something that could pose me a risk? (I really do not trust off-the-shelf routers completely, as they are not supported for very long with security updates. I also never trust ISPs all that much and their own firmware Modem/Routers, especially Canada’s Monopolistic Telecom and Cable Giants.)
I have further questions, but this is a starter.
Thanks for your help.
