ansible.posix.firewalld – Manage arbitrary ports/services with firewalld
This plugin is part of the ansible.posix collection (version 1.3.0).
You might already have this collection installed if you are using the
It is not included in
To check whether it is installed, run
ansible-galaxy collection list.
To install it, use:
ansible-galaxy collection install ansible.posix.
To use it in a playbook, specify:
This module allows for addition or deletion of services and ports (either TCP or UDP) in either running or permanent firewalld rules.
The below requirements are needed on the host that executes this module.
firewalld >= 0.2.11
Not tested on any Debian based system.
Requires the python2 bindings of firewalld, which may not be installed by default.
For distributions where the python2 firewalld bindings are unavailable (e.g Fedora 28 and later) you will have to set the ansible_python_interpreter for these hosts to the python3 interpreter path and install the python3 bindings.
Zone transactions (creating, deleting) can be performed by using only the zone and state parameters “present” or “absent”. Note that zone transactions must explicitly be permanent. This is a limitation in firewalld. This also means that you will have to reload firewalld after adding a zone that you wish to perform immediate actions on. The module will not take care of this for you implicitly because that would undo any previously performed immediate actions which were not permanent. Therefore, if you require immediate access to a newly created zone it is recommended you reload firewalld immediately after the zone creation returns with a changed state and before you perform any other immediate, non-permanent actions on that zone.
- name: permit traffic in default zone for https service ansible.posix.firewalld: service: https permanent: yes state: enabled - name: do not permit traffic in default zone on port 8081/tcp ansible.posix.firewalld: port: 8081/tcp permanent: yes state: disabled - ansible.posix.firewalld: port: 161-162/udp permanent: yes state: enabled - ansible.posix.firewalld: zone: dmz service: http permanent: yes state: enabled - ansible.posix.firewalld: rich_rule: rule service name="ftp" audit limit value="1/m" accept permanent: yes state: enabled - ansible.posix.firewalld: source: 192.0.2.0/24 zone: internal state: enabled - ansible.posix.firewalld: zone: trusted interface: eth2 permanent: yes state: enabled - ansible.posix.firewalld: masquerade: yes state: enabled permanent: yes zone: dmz - ansible.posix.firewalld: zone: custom state: present permanent: yes - ansible.posix.firewalld: zone: drop state: enabled permanent: yes icmp_block_inversion: yes - ansible.posix.firewalld: zone: drop state: enabled permanent: yes icmp_block: echo-request - ansible.posix.firewalld: zone: internal state: present permanent: yes target: ACCEPT - name: Redirect port 443 to 8443 with Rich Rule ansible.posix.firewalld: rich_rule: rule family=ipv4 forward-port port=443 protocol=tcp to-port=8443 zone: public permanent: yes immediate: yes state: enabled