diff --git a/plinth/modules/networks/forms.py b/plinth/modules/networks/forms.py
index 077c8592e..9b8947103 100644
--- a/plinth/modules/networks/forms.py
+++ b/plinth/modules/networks/forms.py
@@ -31,6 +31,9 @@ class ConnectionTypeSelectForm(forms.Form):
 class AddEthernetForm(forms.Form):
     """Form to create a new ethernet connection."""
     name = forms.CharField(label=_('Connection Name'))
+    zone = forms.ChoiceField(
+        label=_('Firewall Zone'),
+        choices=[('external', 'External'), ('internal', 'Internal')])
     ipv4_method = forms.ChoiceField(
         label=_('IPv4 Addressing Method'),
         choices=[('auto', 'Automatic (DHCP)'), ('manual', 'Manual')])
@@ -40,6 +43,9 @@ class AddEthernetForm(forms.Form):
 class AddWifiForm(forms.Form):
     """Form to create a new wifi connection."""
     name = forms.CharField(label=_('Connection Name'))
+    zone = forms.ChoiceField(
+        label=_('Firewall Zone'),
+        choices=[('external', 'External'), ('internal', 'Internal')])
     ssid = forms.CharField(label=_('SSID'))
     auth_mode = forms.ChoiceField(
         label=_('Authentication Mode'),
diff --git a/plinth/modules/networks/networks.py b/plinth/modules/networks/networks.py
index 849fd6e97..6b5aacfe3 100644
--- a/plinth/modules/networks/networks.py
+++ b/plinth/modules/networks/networks.py
@@ -76,18 +76,22 @@ def edit(request, conn_id):
             form = AddEthernetForm(request.POST)
         if form.is_valid():
             name = form.cleaned_data['name']
+            zone = form.cleaned_data['zone']
             ipv4_method = form.cleaned_data['ipv4_method']
             ipv4_address = form.cleaned_data['ipv4_address']
 
             if settings['connection']['type'] == '802-3-ethernet':
-                network.edit_ethernet_connection(conn, name, ipv4_method, ipv4_address)
+                network.edit_ethernet_connection(
+                    conn,
+                    name, zone,
+                    ipv4_method, ipv4_address)
             elif settings['connection']['type'] == '802-11-wireless':
                 ssid = form.cleaned_data['ssid']
                 auth_mode = form.cleaned_data['auth_mode']
                 passphrase = form.cleaned_data['passphrase']
 
                 network.edit_wifi_connection(
-                    conn, name,
+                    conn, name, zone,
                     ssid, auth_mode, passphrase,
                     ipv4_method, ipv4_address)
             else:
@@ -97,6 +101,11 @@ def edit(request, conn_id):
                       'Connection type not supported.') % name)
             return redirect(reverse_lazy('networks:index'))
     else:
+        try:
+            form_data['zone'] = settings['connection']['zone']
+        except KeyError:
+            form_data['zone'] = 'external'
+
         form_data['ipv4_method'] = settings['ipv4']['method']
 
         if settings['ipv4']['addresses']:
@@ -171,6 +180,7 @@ def connect(request, connect_path):
     form = None
     ssid = urllib.parse.unquote_plus(connect_path)
     form_data = {'name': ssid,
+                 'zone': 'external',
                  'ssid': ssid,
                  'auth_mode': 'wpa',
                  'ipv4_method': 'auto'}
@@ -179,6 +189,7 @@ def connect(request, connect_path):
         form = AddWifiForm(request.POST)
         if form.is_valid():
             name = form.cleaned_data['name']
+            zone = form.cleaned_data['zone']
             ssid = form.cleaned_data['ssid']
             auth_mode = form.cleaned_data['auth_mode']
             passphrase = form.cleaned_data['passphrase']
@@ -186,7 +197,7 @@ def connect(request, connect_path):
             ipv4_address = form.cleaned_data['ipv4_address']
 
             network.add_wifi_connection(
-                name,
+                name, zone,
                 ssid, auth_mode, passphrase,
                 ipv4_method, ipv4_address)
             return redirect(reverse_lazy('networks:index'))
@@ -229,10 +240,13 @@ def add_ethernet(request):
         form = AddEthernetForm(request.POST)
         if form.is_valid():
             name = form.cleaned_data['name']
+            zone = form.cleaned_data['zone']
             ipv4_method = form.cleaned_data['ipv4_method']
             ipv4_address = form.cleaned_data['ipv4_address']
 
-            network.add_ethernet_connection(name, ipv4_method, ipv4_address)
+            network.add_ethernet_connection(
+                name, zone,
+                ipv4_method, ipv4_address)
             return redirect(reverse_lazy('networks:index'))
     else:
         form = AddEthernetForm()
@@ -252,6 +266,7 @@ def add_wifi(request):
         form = AddWifiForm(request.POST)
         if form.is_valid():
             name = form.cleaned_data['name']
+            zone = form.cleaned_data['zone']
             ssid = form.cleaned_data['ssid']
             auth_mode = form.cleaned_data['auth_mode']
             passphrase = form.cleaned_data['passphrase']
@@ -259,7 +274,7 @@ def add_wifi(request):
             ipv4_address = form.cleaned_data['ipv4_address']
 
             network.add_wifi_connection(
-                name,
+                name, zone,
                 ssid, auth_mode, passphrase,
                 ipv4_method, ipv4_address)
             return redirect(reverse_lazy('networks:index'))
diff --git a/plinth/network.py b/plinth/network.py
index f7cd6e00b..50a5e057e 100644
--- a/plinth/network.py
+++ b/plinth/network.py
@@ -95,13 +95,14 @@ def get_active_connection(name):
     return connections.get(name)
 
 
-def edit_ethernet_connection(conn, name, ipv4_method, ipv4_address):
+def edit_ethernet_connection(conn, name, zone, ipv4_method, ipv4_address):
     settings = conn.GetSettings()
 
     new_settings = {
         'connection': {
             'id': name,
             'type': settings['connection']['type'],
+            'zone': zone,
             'uuid': settings['connection']['uuid'],
         },
         '802-3-ethernet': {},
@@ -116,7 +117,7 @@ def edit_ethernet_connection(conn, name, ipv4_method, ipv4_address):
     conn.Update(new_settings)
 
 
-def edit_wifi_connection(conn, name,
+def edit_wifi_connection(conn, name, zone,
                          ssid, auth_mode, passphrase,
                          ipv4_method, ipv4_address):
     settings = conn.GetSettings()
@@ -125,6 +126,7 @@ def edit_wifi_connection(conn, name,
         'connection': {
             'id': name,
             'type': settings['connection']['type'],
+            'zone': zone,
             'uuid': settings['connection']['uuid'],
         },
         '802-11-wireless': {
@@ -197,11 +199,12 @@ def deactivate_connection(name):
               'Connection not found.') % name)
 
 
-def add_ethernet_connection(name, ipv4_method, ipv4_address):
+def add_ethernet_connection(name, zone, ipv4_method, ipv4_address):
     conn = {
         'connection': {
             'id': name,
             'type': '802-3-ethernet',
+            'zone': zone,
             'uuid': str(uuid.uuid4()),
         },
         '802-3-ethernet': {},
@@ -217,13 +220,14 @@ def add_ethernet_connection(name, ipv4_method, ipv4_address):
     NetworkManager.Settings.AddConnection(conn)
 
 
-def add_wifi_connection(name,
+def add_wifi_connection(name, zone,
                         ssid, auth_mode, passphrase,
                         ipv4_method, ipv4_address):
     conn = {
         'connection': {
             'id': name,
             'type': '802-11-wireless',
+            'zone': zone,
             'uuid': str(uuid.uuid4()),
         },
         '802-11-wireless': {