ansible.builtin.firewalld (v2.6.20) — module

Install Ansible via pip

Install with pip install ansible==2.6.20

Description

This module allows for addition or deletion of services and ports either tcp or udp in either running or permanent firewalld rules.

Requirements

• firewalld >= 0.2.11

Usage examples

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- firewalld:
    service: https
    permanent: true
    state: enabled

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- firewalld:
    port: 8081/tcp
    permanent: true
    state: disabled

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- firewalld:
    port: 161-162/udp
    permanent: true
    state: enabled

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- firewalld:
    zone: dmz
    service: http
    permanent: true
    state: enabled

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- firewalld:
    rich_rule: 'rule service name="ftp" audit limit value="1/m" accept'
    permanent: true
    state: enabled

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- firewalld:
    source: 192.0.2.0/24
    zone: internal
    state: enabled

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- firewalld:
    zone: trusted
    interface: eth2
    permanent: true
    state: enabled

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- firewalld:
    masquerade: yes
    state: enabled
    permanent: true
    zone: dmz

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- firewalld:
    zone: custom
    state: present
    permanent: true

Scanned by Steampunk Spotter

• Success
  Steampunk Spotter scan finished with no errors, warnings or hints.

- name: Redirect port 443 to 8443 with Rich Rule
  firewalld:
    rich_rule: rule family={{ item }} forward-port port=443 protocol=tcp to-port=8443
    zone:      public
    permanent: true
    immediate: true
    state:     enabled
  with_items:
    - ipv4
    - ipv6

Inputs

    
port:
    description:
    - Name of a port or port range to add/remove to/from firewalld. Must be in the form
      PORT/PROTOCOL or PORT-PORT/PROTOCOL for port ranges.

zone:
    choices:
    - work
    - drop
    - internal
    - external
    - trusted
    - home
    - dmz
    - public
    - block
    default: system-default(public)
    description:
    - 'The firewalld zone to add/remove to/from (NOTE: default zone can be configured
      per system but "public" is default from upstream. Available choices can be extended
      based on per-system configs, listed here are "out of the box" defaults).

      '

state:
    choices:
    - enabled
    - disabled
    - present
    - absent
    description:
    - 'Enable or disable a setting. For ports: Should this port accept(enabled) or reject(disabled)
      connections. The states "present" and "absent" can only be used in zone level operations
      (i.e. when no other parameters but zone and state are set).

      '
    required: true

source:
    description:
    - The source/network you would like to add/remove to/from firewalld
    version_added: '2.0'
    version_added_collection: ansible.builtin

service:
    description:
    - Name of a service to add/remove to/from firewalld - service must be listed in output
      of firewall-cmd --get-services.

timeout:
    default: 0
    description:
    - The amount of time the rule should be in effect for when non-permanent.

immediate:
    default: 'no'
    description:
    - Should this configuration be applied immediately, if set as permanent
    type: bool
    version_added: '1.9'
    version_added_collection: ansible.builtin

interface:
    description:
    - The interface you would like to add/remove to/from a zone in firewalld
    version_added: '2.1'
    version_added_collection: ansible.builtin

permanent:
    description:
    - 'Should this configuration be in the running firewalld configuration or persist
      across reboots. As of Ansible version 2.3, permanent operations can operate on firewalld
      configs when it''s not running (requires firewalld >= 3.0.9). (NOTE: If this is
      false, immediate is assumed true.)

      '

rich_rule:
    description:
    - Rich rule to add/remove to/from firewalld.

masquerade:
    description:
    - The masquerade setting you would like to enable/disable to/from zones within firewalld
    version_added: '2.1'
    version_added_collection: ansible.builtin