On Sun, May 17, 2020 at 02:40:45PM +0800, Ed Greshko wrote:

I think the following is a "bug" even if it is just minor.  This is on F32.

[root@meimei ~]# firewall-cmd --get-active-zone libvirt   interfaces: virbr0 public   interfaces: wlp4s0 enp2s0

The following seems correct for enp2s0.

[egreshko@meimei ~]$ firewall-cmd --get-zone-of-interface=enp2s0 public

[root@meimei ~]# firewall-cmd --query-interface=enp2s0 yes

But then for virbr0

[root@meimei ~]# firewall-cmd --get-zone-of-interface=virbr0 libvirt

Seems fine, yet this is "no"

[root@meimei ~]# firewall-cmd --query-interface=virbr0 no

If --zone is not specified then the default zone is assumed. In your case probably "FedoraWorkstation" or "public".

From the firewall-cmd(1) man page:

Options to Adapt and Query Zones Options in this section affect only one particular zone. If used with --zone=zone option, they affect the zone zone. If the option is omitted, they affect default zone (see --get-default-zone).

but

[root@meimei ~]# firewall-cmd --zone=libvirt --query-interface=virbr0 yes

To make matters more confusing to me.

[root@meimei ~]# firewall-cmd --list-interfaces wlp4s0 enp2s0

Why isn't virbr0 listed when --get-active-zone shows that as an interface?

See above comment. Same reason.