firewalld zones with tun interfaces

["Joseph L. Casale" <jcasale activenetwerx com>]

I have a system controlled openvpn configuration that creates a tun interface.
As the resulting tun interface falls under network manager, I created an up script
That executes `/usr/bin/nmcli connection modify tun0 connection.zone my_zone` 
where the actual interface name is passed in. This seemingly only works some of the
time and manual invocations of the above command simply fail to move the interface
into the zone.

What is the correct way to ensure this interface is always the required zone?

Thanks,
jlc