Newbie Questions & Observations

Hi all, I just installed Fedora 20 on my desktop and I'm playing with firewalld for the first time. I read the docs and with the new rich-rules I think I'm a happy camper so far. I have some questions & observations: # firewall-config (GUI app) I opened a bugzilla because every time you start the app it starts maximized: https://bugzilla.redhat.com/show_bug.cgi?id=1046811 # Target for a Zone When using firewall-config and you switch to permanent configuration, in order to edit one of the zone properties, there's a Target drop-down list there. When I changed ACCEPT to DROP for the public zone (my default) I noticed only the FORWARD chain was changed. I did an "iptables -L -n -v" in order to confirm this. The actual chain affected is FWDI_public (where the last REJECT rule is replaced by a DROP). Shouldn't the IN_public (for public zone) have a DROP statement as well? Since it doesn't have it, a REJECT from the default INPUT chain is what gets applied. Is this a bug? Also, when I do this I loose all my connections (can't browse the web, anything..). I have dissected the resulting iptable rules and I only see the change in the FWDI_public chain. Nothing else. I can't find the culprit. I have to change the target back to ALLOW for things to get normal again. In a nutshell, I would like all packets to be dropped for all services that are not allowed. How can I do this via firewall-cmd/firewall-config? I know there's a drop zone but still would like to learn how to change the default target for a given zone. # Immutable What does it mean for a zone to be immutable? Is it that, once loaded, you can't change it? (add/remove rules)? When I change my default zone to the drop zone, I still can add/remove services from it. # Best Practices If I'm going to add/remove services for a given zone, is it better to just clone one zone and have one of my own? Should I leave all the stock zones as they are? Thanks in advance. Best regards, Jorge