Why won't firewalld keep its configuration across restarts?# systemctl start firewalld# systemctl -l status firewalldfirewalld.service - firewalld - dynamic firewall daemon   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)   Active: active (running) since Sat 2016-10-22 16:53:34 PDT; 6s ago Main PID: 15163 (firewalld)   CGroup: /system.slice/firewalld.service           15163 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopidOct 22 16:53:34 firewall.localdomain systemd[1]: Started firewalld - dynamic firewall daemon.# firewall-cmd --get-active-zonesexternal  interfaces: enp4s0 enp5s5# cat /etc/firewalld/zones/external.xml<?xml version=1.0 encoding=utf-8?><zone>  <short>External</short>  <description>For use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>  <interface name=enp4s0/>  <icmp-block name=echo-reply/>  <icmp-block name=router-solicitation/>  <icmp-block name=destination-unreachable/>  <icmp-block name=router-advertisement/>  <masquerade/></zone># cat /etc/firewalld/zones/trusted.xml<?xml version=1.0 encoding=utf-8?><zone target=ACCEPT>  <short>Trusted</short>  <description>All network connections are accepted.</description>  <interface name=enp5s5/></zone># firewall-cmd --change-interface=enp5s5 --zone=trustedsuccess# firewall-cmd --get-active-zonesexternal  interfaces: enp4s0trusted  interfaces: enp5s5# firewall-cmd --permanent --change-interface=enp5s5 --zone=trustedsuccess# systemctl restart firewalld# systemctl -l status firewalldfirewalld.service - firewalld - dynamic firewall daemon   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled)   Active: active (running) since Sat 2016-10-22 16:54:58 PDT; 5s ago Main PID: 15786 (firewalld)   CGroup: /system.slice/firewalld.service           15786 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopidOct 22 16:54:58 firewall.localdomain systemd[1]: Started firewalld - dynamic firewall daemon.# firewall-cmd --get-active-zonesexternal  interfaces: enp4s0 enp5s5
CentOS 7: Firewalld ignores its configuration files
centos;firewalld
I found the solution in CentOS bug 7407# nmcli conn modify enp5s5 connection.zone trusted# nmcli conn modify enp4s0 connection.zone externalIf connection.zone is blank, interfaces get put in the zone specified as default.