Firejail: Why? Warning: networking feature is disabled in Firejail configuration file

[julien-tmp]

- firejail version: 0.9.58.2
 - Linux distribution: Linux Mint LMDE
 - Problem did no exist in December last year
 - firejail withthe `--noprofile` argument: Does not give a warning about networking

Why is networking now disabled by default and how to enable it?
For example, when running Firefox I get:

Reading profile /etc/firejail/default.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-passwdmgr.inc
Reading profile /etc/firejail/disable-programs.inc
Warning: networking feature is disabled in Firejail configuration file

I did enable the network with network yes in /etc/firejail/firejail.config

[Fred-Barclay]

Hi @julien-tmp
Please also install firejail-profiles from stretch backports so you can get the correct firefox profile. Currently, the profile isn't on your system so firejail is trying to use the default profile for firefox instead of the correct one.

Cheers!
Fred

[julien-tmp]

Hi @Fred-Barclay, thank you! I am still encountering this issue after installing the profiles:

firejail --netfilter=/etc/firejail/onlylocal.net --private=/home/username/.firejail-profiles/lan-mgmt firefox -no-remote
Error: networking feature is disabled in Firejail configuration file

Cheers,
Julien

[reinerh]

You need to change restricted-network in the firejail.config. Or you disable the netfilter setting in the firefox profile.

[julien-tmp]

Thank you for the tip @reinerh, however, I am not sure if I understand everythin
I have it like this:

# networking features should also be enabled (network yes).
# Restricted networking grants access to --interface, --net=ethXXX and
# --netfilter only to root user. Regular users are only allowed --net=none.
restricted-network yes

What would be the consequence to put it to no?
Does it open any security hole?

[Vincent43]

Putting it to no will allow to create new network interfaces which could bypass your network security settings.

[julien-tmp]

It worked, thanks!