Description of problem: In Fedora 18 I see many empty chains or collections of empty chains in output of iptables -L firewalld could create all necessary chains and super-chains just in case that particular zone/chain is used. This will make iptables output easier to read/track. Example of empty chains and chains containing empty chains only: Chain FORWARD_ZONES (1 references) target prot opt source destination FWDO_ZONE_public all -- anywhere anywhere FWDI_ZONE_public all -- anywhere anywhere Chain FORWARD_direct (1 references) target prot opt source destination Chain FWDI_ZONE_public (1 references) target prot opt source destination FWDI_ZONE_public_deny all -- anywhere anywhere FWDI_ZONE_public_allow all -- anywhere anywhere Chain FWDI_ZONE_public_allow (1 references) target prot opt source destination Chain FWDI_ZONE_public_deny (1 references) target prot opt source destination
Without creating the chains and rules for unused zones, it would take some time to add an interface to a zone, that has been unused before.
... which does not happen so often - in most cases only once per boot or when user changes the zone of interface. I had already been thinking about it before Marian filled the request, but haven't had time yet to investigate it more.
Should be AFAICT fixed upstream with https://git.fedorahosted.org/cgit/firewalld.git/commit/?id=1236770365336e2cffe01035910fe50bc311bd85
firewalld-0.3.9-1.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/firewalld-0.3.9-1.fc20
firewalld-0.3.9-1.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/firewalld-0.3.9-1.fc19
Package firewalld-0.3.9-1.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing firewalld-0.3.9-1.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-0738/firewalld-0.3.9-1.fc20 then log in and leave karma (feedback).
firewalld-0.3.9-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
firewalld-0.3.9.3-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.