samenome<p>"Don't use shorewall anymore, it's old" my stupid brain said. And who wants to be 'old'? Not me. No. I am hip, chic, sprightly-brained. I also live a very happy rich fantasy existence, keep that pin away from my bubble!</p><p>DuckDuckGo: 'nftables replacement for shorewall' gets: <br>"Just accept that Firewalld is a major player, and that iptables is on its way out with nftables being more robust and consistent. And nftables is the default Firewalld back end. Firewalld is good once you get used to what it's doing. And it's the default on Fedora/CentOS/RHEL and SUSE/openSUSE Leap/Tumbleweed. "</p><p>I am always using <a href="https://aus.social/tags/Debian" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Debian</span></a>, (because, ahem, old? I'd dare not say) including on this firewall box. But, there's a firewalld package. Probably best to go with the flow ....</p><p>So I install firewalld, then muck about with dnsmasq, then turn back to fiirewalld, which seems enabled without me asking consciously asking for it (?) oh well ...</p><p>Then I get to:<br>Machine: A zone called 'work' exists.<br>Me: nnah, not here in my shed it doesn't.<br><a href="https://aus.social/tags/firewall" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>firewall</span></a>-cmd --delete-zone=work --permanent<br>Machine: Error: BUILTIN_ZONE: 'work' is built-in zone</p><p>What!? Say the fuck WHAT? "work"???<br>What fresh hell is this? Am I not allowed to be away from work even here at my shed with the magpies and roos?</p><p>Christ on a bike. Well I'll just get my bigger stick, and do:<br><a href="https://aus.social/tags/rm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>rm</span></a> /etc/firewalld/zones/work*<br>and restart firewalld.<br>... It is back ... 🤐 <br>Machine: Error: BUILTIN_ZONE: 'work' is built-in zone<br>Oh. ComeTheFuckON!</p><p><a href="https://aus.social/tags/firewalld" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>firewalld</span></a>, unless something changes my mind in the night, you are headed for the bin in the morning. </p><p>And some unasked-for advice from me to the <a href="https://aus.social/tags/firewalld" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>firewalld</span></a> people: You MIGHT, just might, have permanent built-ins for 'drop' and 'bridge', ... perhaps. But 'work'? Fuck off to the place with the fuckoff sign, read it carefully, then fuck off further, yes and your friends too. Example zones? fine. Recipes about common 'internal'/'dmz'/'external' arrangements? also fine. Helpful in fact. Demanding that I have a "work" zone??? </p><p>'WORK' </p><p><a href="https://aus.social/tags/JFC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>JFC</span></a> <a href="https://aus.social/tags/cunts" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cunts</span></a></p><p>To think that I fought the good fight for the cultural insensitivity of <a href="https://aus.social/tags/DMZ" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DMZ</span></a>. (oh yeah - that little fucker? built-in too, ofCourseItIs)<br>What a waste of my time.<br> <br><a href="https://aus.social/tags/networking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>networking</span></a> people: If you had a four-port PCbox configured as a debian <a href="https://aus.social/tags/firewall" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>firewall</span></a>, what would you use to make the configuration of <a href="https://aus.social/tags/nftables" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>nftables</span></a> easy/safe/happy/fucker-free?</p>