netplan can not configure firewalld zone

[Sönke Weis]

On a PC with 2 nic's, I would like to set up a firewall. One nic is for internal network, the other nic is facing public.
I like the systax from firewalld, so I rather use that instead of ufw.
With netplan I configured my interfaces, but there I found no way to make the following persistent:

root@AAA-ONC:~# firewall-cmd --permanent --zone=internal --add-interface=enp2s0
The interface is under control of NetworkManager, setting zone to 'internal'.
success

After reboot NetworkManager resettet that command.
root@AAA-ONC:~# firewall-cmd --get-active-zones
docker
  interfaces: br-d1c181616ae5 docker0
public
  interfaces: enp1s0 enp2s0

Linux AAA-ONC 5.19.0-35-generic #36~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Fri Feb 17 15:17:25 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Package: netplan.io
Version: 0.105-0ubuntu2~22.04.3
Package: network-manager
Version: 1.36.6-0ubuntu2

[Danilo Egea Gondolfo (danilogondolfo)]

Hello there,

Netplan doesn't support configuring zones in network manager keyfiles yet. Although you can do that with the "passthrough" property. Example:

network:
  version: 2
  renderer: NetworkManager
  ethernets:
    enp2s0:
      dhcp4: true
      networkmanager:
        passthrough:
          connection.zone: internal

After applying your configuration (or rebooting) you will find the lines below in /var/run/NetworkManager/system-connections/netplan-enp2s0.nmconnection:

#Netplan: passthrough setting
zone=internal

I hope it helps :)

[Sönke Weis (struland)]

Hello,
:) :) :)
many thanks for your help! It worked on first try.

Also I think netplan is a very good concept. Just put the config into a YAML and have something that is super concise.
I very much like the cmd "netplan try". Mighty, when doing changes to do remote config.