Hello everyone,

I'm looking to increase the security of my computers a bit through firewalld (with the KDE settings). I have a desktop and a laptop, both running Fedora 40 with KDE plasma. I don't have access to the router's firewalls etc etc this is only for my machines.

The issue is I'm having a hard time navigating the zones and setting rules the way I want. I don't wanna deal with switching to UFW and while I generally like CLI stuff I'd prefer to generally stick with the GUI here even though I find it a bit confusing (I will use CLI if necessary tho).

Anyways, let's get to the point. Firstly the only difference between the laptop and desktop, in terms of use-case, is that on my desktop I'm always connected to my home's subnet via LAN while on my laptop I often connect to public wifis, so naturally the laptop is a little less secure.

For my use-case I care about 3 network interfaces:

• tailscale: this is the one I use to ssh into my machines and stuff and I want this to be the only interface which allows me to ssh. This is because not only it allows me to ssh remotely but also I figure is also the most secure way to use ssh as the tailscales team is probably better at security than I am.
• Proton VPN's: this I use for gaming, web browsing and seeding Linux ISOs so I'd like settings that block everything without affecting these usecases.
• normal internet: I almost always have my VPN on but occasionally I don't for one reason or another and I only use this for web browsing and gaming via steam. Settings I'd like here are essentially the same as ProtonVPN's but stricter if it makes sense to be stricter, especially on the laptop where it's likely a public wifi I'm conencting to when I'm not home. If it's possible I'd also like this interface to be hidden from nmap scans.

I do some light pentesting to learn so there's also that.

I currently have every relevant connection set to FedoraWorkstation zone by default except I manually tell the laptop to switch to public zone for public wifis (I'd change the default to be public and specify other zones for non-public connections but rn I'm in a period of time when I'm only connecting it to my home network so I wanna figure out this out first).

My question is, which zones should I use and what rules should I implement to make this more secure?

Thanks in advance