diff --git a/rust/agama-server/src/network/model.rs b/rust/agama-server/src/network/model.rs
index 624618094a..0c09bd2d05 100644
--- a/rust/agama-server/src/network/model.rs
+++ b/rust/agama-server/src/network/model.rs
@@ -380,6 +380,7 @@ pub struct Connection {
     pub id: String,
     pub uuid: Uuid,
     pub mac_address: MacAddress,
+    pub firewall_zone: Option<String>,
     pub ip_config: IpConfig,
     pub status: Status,
     pub interface: Option<String>,
@@ -448,6 +449,7 @@ impl Default for Connection {
             id: Default::default(),
             uuid: Uuid::new_v4(),
             mac_address: Default::default(),
+            firewall_zone: Default::default(),
             ip_config: Default::default(),
             status: Default::default(),
             interface: Default::default(),
diff --git a/rust/agama-server/src/network/nm/dbus.rs b/rust/agama-server/src/network/nm/dbus.rs
index 7630c8aaca..1d60f07f71 100644
--- a/rust/agama-server/src/network/nm/dbus.rs
+++ b/rust/agama-server/src/network/nm/dbus.rs
@@ -62,6 +62,10 @@ pub fn connection_to_dbus<'a>(
         connection_dbus.insert("master", "".into());
     }
 
+    if let Some(zone) = &conn.firewall_zone {
+        connection_dbus.insert("zone", zone.into());
+    }
+
     result.insert("ipv4", ip_config_to_ipv4_dbus(&conn.ip_config));
     result.insert("ipv6", ip_config_to_ipv6_dbus(&conn.ip_config));
     result.insert("match", match_config_to_dbus(&conn.match_config));
@@ -569,6 +573,11 @@ fn base_connection_from_dbus(conn: &OwnedNestedHash) -> Option<Connection> {
         base_connection.match_config = match_config_from_dbus(match_config)?;
     }
 
+    if let Some(zone) = connection.get("zone") {
+        let zone: &str = zone.downcast_ref()?;
+        base_connection.firewall_zone = Some(zone.to_string());
+    }
+
     if let Some(ethernet_config) = conn.get(ETHERNET_KEY) {
         base_connection.mac_address = mac_address_from_dbus(ethernet_config)?;
     } else if let Some(wireless_config) = conn.get(WIRELESS_KEY) {