FreeKB - Ansible firewalld module
Ansible - firewalld module

If you are not familiar with modules, check out Ansible - Getting Started with Modules.

The firewalld module is used to modify firewalld.

The firewalld module is part of the ansible.posix collection. You may need to install the ansible.posix collection to use the firewalld module.

The interface option is used to add or remove an interface, such as eth0, from a zone. Refer to Firewalld - Bind an interface to a zone for a better understand of interfaces and zones. 

  • When state is enabled, the interface will be added (bound)
  • When state is disabled, the interface will be removed (unbound)
- name: bind interface eth0 to the public zone
  firewalld:
    interface: eth0
    state: enabled
    zone: public

 

The service option is used to enable or disable connections to a protocols common port, such as when HTTP is using port 80. Refer to Firewalld - allow or deny a service for a better understanding of how firewalld is configured to allow or deny a connection to a service.

- name: allow HTTP connections
  firewalld:
    service: http
    state: enabled

 

The port option can be used to enable or disable connections to a port number. This is typically used when a protocol is not using the default port associated with the protocol, such as when HTTP is using 8080. Refer to Firewalld - allow or deny a port for a better understanding of how firewalld is configured to allow or deny a connection to a port.

- name: allow TCP connections to port 8080
  firewalld:
    port: 8080/tcp
    state: enabled

 

The source option can be used to only allow connections from certain IP addresses. In this example, only connections from IP addresses in the 192.168.0.0/24 subnet will be allowed. Refer to Firewalld - allow certain IP addresses (source) for a better understanding of how firewalld is configured to allow connections from certain IP addresses.

- name: only allow connections from subnet 192.168.0.0/24
  firewalld:
    source: 192.168.0.0/24
    state: enabled

 

The icmp_block_inversion option can be used to enable or disable ICMP block inversion. Refer to Firewalld - allow or deny ICMP for a better understanding of ICMP block inversion.

  • When state is enabled, ICMP block inversion will be turned on
  • When state is disabled, ICMP block inversion will be turned off
- name: disable ICMP block inversion
  firewalld:
    icmp_block_inversion: yes
    state: disabled

 

The icmp_block option can be used to add or remove an ICMP block. Refer to Firewalld - allow or deny ICMP for a better understanding of ICMP block inversion.

  • When state is enabled, the ICMP block will be added
  • When state is disabled, the ICMP block will be removed
- name: allow ICMP block echo-request
  firewalld:
    icmp_block: echo-request
    state: enabled

 

The masquerade option can be used to enable or disable IP address masquerade. Refer to Firewalld - IP address masquerade for a better understanding of IP address masquerading.

  • When state is enabled, IP address masquerade will be turned on
  • When state is disabled, IP address masquerade will be turned off
- name: enable IP address masquerade
  firewalld:
    masquerade: yes
    state: enabled

 

The rich_rule option can be used to create a rich rule, which is a special type of unique rule that is beyond the scope of this article. In this example, a rich rule is created to only allow one FTP connection per minute. Refer to Firewalld - rich rules for a better understanding of how firewalld is configured with rich rules.

- name: rich rule to only allow one FTP connection per minute
  firewalld:
    rich_rule: rule service name="ftp" audit limit value="1/m" accept
    state: enabled

 

The firewalld module does not have a way to reload firewalld. The systemd module can be used to restart the firewalld service.

- name: restart firewalld
  systemd:
    name: firewalld
    state: restarted
    daemon_reload: true

 

Optional Options

  • immediate: yes or no - This is only used when permenent is set to "yes". If immediate was not used or set to "no", the change would not be applied until the firewall is reloaded. By setting immediate to "yes", the change will be applied immediately.
  • permanent: yes or no - whether or not the change should be permanently applied to the firewall. You will probably also want to set "immediate" to "yes".
  • state: enabled or disabled - whether or not to enable/add or disable/remove a configuration
  • zone: if not specified, the default zone will be used, which is typically the "public" zone.

Example

- name: allow HTTP connections
  firewalld:
    service: http
    state: enabled
    permanent: yes
    immediate: yes
    zone: public

 



Add a Comment




We will never share your name or email with anyone. Enter your email if you would like to be notified when we respond to your comment.




Please enter 624b9 in the box below so that we can be sure you are a human.




Comments

Web design by yours truely - me, myself, and I   |   jeremy.canfield@freekb.net   |