after more tests, it appears that the zone is partialy applied: $ nmcli -f NAME,DEVICES,ZONE con status NOM PÉRIPHÉRIQUES ZONE WIFI wlp3s0 home VPN wlp3s0 work but $ firewall-cmd --get-active-zones home interfaces: wlp3s0 when port 9000 is open in zone work only, telnet on port 9000 from the other side of the vpn answers "no route to host" when port 9000 is open in zone home only, telnet on port 9000 from the other side of the vpn answers "no route to host" when port 9000 is open in zone public (which is the default zone) only, telnet on port 9000 from the other side of the vpn is ok as if VPN was in fact in default zone… _______________________________________________ firewalld-users mailing list firewalld-users(a)lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/firewalld-users