[Module] ZFW v1.0.10 — host firewall as a ZimaOS dashboard tile

Insight & Feedback
12

Yes — that’s deliberate, and your reasoning is spot on. Two reasons:

  1. Boot timing. ZFW is a host-level firewall (netfilter/iptables rules + systemd units + the zfwd daemon), not a Docker app. zfw.service runs zfw apply early in boot to load the ruleset. So it has to live on a device that’s guaranteed mounted at that point. /DATA is the internal ZimaOS system disk (always available early); /DATA/AppData on your box is redirected to the SATA SSD, which mounts later. Installing there would leave a window at every boot where the firewall isn’t loaded yet — exactly what you don’t want from a firewall.
  2. It’s not an “app”. /DATA/AppData/ is the convention for containerized AppStore apps (Docker volumes, per-app data, app lifecycle). ZFW manipulates the host directly, so keeping it in /DATA/zfw keeps it out of the app lifecycle (it won’t get swept up when you install/remove apps) and next to the other host-level state.

Re: port 7681 (terminal) getting blocked

Good catch — that’s a gap in the default whitelist, not intended. ZFW ships with a LAN whitelist of TCP 22, 80, 443, 445, 139, 8200, 9527, 1910 (+ some UDP for mDNS/SMB discovery). The ttyd terminal on 7681 isn’t in that list, so it gets dropped. SSH (22) and the WebUI (80/443) stay open — that’s why only the terminal broke.

Since you’ve stopped ZFW you’ve got your terminal back, so just add the rule and re-enable:

Easiest — in the ZFW UI: add a rule allow TCP 7681 from 192.168.1.0/24 (your LAN), then Apply + Commit.

Or from a shell:

add the rule in the UI or in /DATA/zfw/rules.json, then:

sudo systemctl restart zfw-ui # zfwd recompiles the ruleset
sudo /DATA/zfw/zfw apply # load into live iptables
sudo /DATA/zfw/zfw commit # make it boot-persistent
The apply step is the one people miss — without it the rule sits in the config but never reaches iptables. commit makes it survive reboot and cancels the deadman rollback timer.

I’ll add 7681 to the default whitelist (or at least flag it prominently in the README) so nobody else locks themselves out of their terminal. Thanks for reporting it!

1 Like