ansible-firewalld-role

KO | EN

gitlite — search

#python #android #react #ios #hacktoberfest #reactjs #nodejs #api #docker #cpp #kotlin #javascript

ansible-firewalld-role

★ 18 Open GitHub ↗

Advanced Base role to configure firewalld through variables.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

ansible-firewalld-role
=========

Allows you to configure firewalld.

Config options:
* default zone
* interface of a zone
* source of a zone
* service rules (with purging of undefined rules, if wanted)
* port rules
* rich rules
* policies

Requirements
------------

Tested on RHEL 7, CentOS 7 and Fedora 29 only.

Ansible 2.0 or above

Role Variables
--------------
**It is not necessary to use all these variable blocks, you can use only the config options you really need.**

The following variable is used to define the default zone of firewalld:

```
    default_zone: (optional, default: public)
```

---

The following variables are used to define which interfaces assigned to zones:

```
    firewalld_zone_interfaces:
      - name: (required, e.g. public)
        interfaces: (required, list of interfaces, one or multiple possible)
```

Example:
```
    firewalld_zone_interfaces:
      - name: trusted
        interfaces:
          - eth1
          - eth2
      - name: public
        interfaces:
          - eth0
```

---

The following variables are used to define the source of a zone:

```
    firewalld_zone_source:
      public:
        zone: (required, zone name)
        source: (required, array of sources e.g. [ 192.168.1.1/24, 10.16.16.23 ])
        state: (optional, only values: enabled|disabled, default: enabled)
        permanent: (optional, only values: true|false, default: true)
        immediate: (optional, only values: true|false, default: true)
```

---

The following variables are used to define a service rule:

```
    firewalld_service_rules: 
      name:
        service: (optional, default: use name if service is not defined)
        state: (optional, only values: enabled|disabled, default: enabled)
        zone: (optional, default: public)
        permanent: (optional, only values: true|false, default: true)
        immediate: (optional, only values: true|false, default: true)
```

Examples:
```
    firewalld_service_rules: 
      ssh:
        state: enabled
        zone: public
        permanent: true
        immediate: true
```
or
```
    firewalld_service_rules:
        ssh_trusted:
            service: ssh
            state: enabled
            zone: trusted
        ssh_public:
            service: ssh
            state: enabled
            zone: public
```

---

The following variables are used to purge undefined active service and port rules:

```
    firewalld_purge_services: (optional, only values: true|false, default: false)
    firewalld_purge_ports: (optional, only values: true|false, default: false)
```

---

The following variables are used to define a port rule:

```
    firewalld_port_rules:
      name:
        port: (required, port or port range)
        protocol: (optional, only values: tcp|udp, default: tcp)
        state: (optional, only values: enabled|disabled, default: enabled)
        zone: (optional, default: public)
        permanent: (optional, only values: true|false, default: true)
        immediate: (optional, only values: true|false, default: true)
```

---

The following variables are used to define a rich rule:

```
    firewalld_rich_rules:
      name:
        rule: (required, a complete rule in firewalld rich language)
        state: (optional, only values: enabled|disabled, default: enabled)
        zone: (optional, default: public)
        permanent: (optional, only values: true|false, default: true)
        immediate: (optional, only values: true|false, default: true)
```
The following variable is used to define ipsets. Only hash:ip type is supported.
NOTE: ipsets created outside of this variable will not be managed or removed
```
    firewalld_ipsets:
     - name: example1
       entries:
       - 192.168.0.1
       - 192.168.0.5
     - name: example2
       entries:
       - 192.168.0.7
       - 192.168.0.11
```

The following variable is used to configure policies:
```
    firewalld_policies:
      - name: (required)
        description (optional, default: "")
        target: (optional, only values: "ACCEPT"|"REJECT", default: "REJECT")
        services: (optional, default: [])
        ports: (optional, default: [])
        protocols: (optional, default: [])
        egress_zones: (optional, default: [])
        ingress_zones: (optional, default: [])
        forward_ports: (optional, default: [])
        source_ports: (optional, default: [])
        icmp_blocks: (optional, default: [])
        rich_rules: (optional, default: [])
        masquerade: (optional, only values: true|false, default: false)
```

Handlers
--------

These are the handlers that are defined in this role:

* restart firewalld

Example Playbook
----------------

```
    - hosts: server
      become: yes
      become_user: root
      become_method: su
      roles:
        - ansible-firewalld-role
      vars:
        default_zone: public
        firewalld_zone_interfaces:
          - name: trusted
            interfaces:
              - eth1
              - eth2
          - name: public
            interfaces:
              - eth0
        firewalld_zone_source:
          trusted:
            zone: trusted
            source:
              - "192.168.1.0/24"
              - "10.0.16.12"
            state: enabled
            permanent: true
            immediate: true
        firewalld_service_rules:
          ssh:
            state: enabled
            zone: public
            permanent: true
            immediate: true
        firewalld_port_rules:
          smtp:
            port: 25
            protocol: tcp
            state: enabled
            zone: public
            permanent: true
            immediate: true
        firewalld_rich_rules:
          ftp_audit:
            rule: 'rule service name="ftp" audit limit value="1/m" accept'
            state: enabled
            zone: public
            permanent: true
            immediate: true
        firewalld_ipsets:
          - name: example1
            entries:
            - 192.168.0.1
            - 192.168.0.5
          - name: example2
            entries:
            - 192.168.0.7
            - 192.168.0.11
        firewalld_policies:
          - name: libvirt-to-host
            target: ACCEPT
        firewalld_purge_services: true
        firewalld_purge_ports: true
```

License
-------

MIT

ansible-firewalld-role

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README