Ansible: firewalld and adding new zone

ansible firewalld
Magick picture Magick · Feb 17, 2017 · Viewed 12.5k times · Source

I' trying to add the following to an Ansible playbook:

firewall-cmd --permanent --new-zone dockerc
firewall-cmd --permanent --zone dockerc --add-source 172.17.0.0/16
firewall-cmd --permanent --zone dockerc --add-port 8443/tcp
firewall-cmd --permanent --zone dockerc --add-port 53/udp

But according to http://docs.ansible.com/ansible/firewalld_module.html zones do not have an option to add a new zone.

Does anyone know if its possible to add dockerc as a new zone using Ansible?

Answer

sbaildon picture sbaildon · Jun 27, 2018

As of 2017-12-12, specifically commit 8475171f67f, the firewalld module supports the creation (and deletion) of zones.

- firewalld:
    zone: custom
    state: present
    permanent: true

Set state to present or absent, and ensure that zone, state, and permanent are the only keys in the task.

Notes from the source code

  • Zone transactions (creating, deleting) can be performed by using only the zone and state parameters "present" or "absent". Note that zone transactions must explicitly be permanent. This is a limitation in firewalld. This also means that you will have to reload firewalld after adding a zone that you wish to perfom immediate actions on. The module will not take care of this for you implicitly because that would undo any previously performed immediate actions which were not permanent. Therefor, if you require immediate access to a newly created zone it is recommended you reload firewalld immediately after the zone creation returns with a changed state and before you perform any other immediate, non-permanent actions on that zone.

Related questions

How to open firewall port with ansible firewalld task on Centos 7

I have a task in my ansible-playbook script to open TCP port on a remote machine. but when I run my ansible playbook it throws an error. But when i run "firewall-cmd --permanent --zone=public --add-port=1234/tcp" and "firewalld-cmd --reload" …

Read More
How to reload Firewalld service using Ansible?

I added some rule to firewalld in centos 7 with ansible. But I must reload firewalld daemon thus service work properly. Is there any idea? Here is my ansible code: - name: Add port to firewalld firewalld: port: "{{ item }}" permanent: yes …

Read More
The task includes an option with an undefined variable

I have the below vars file and Ansible task which allows some ports for a specific source IPs on the firewall. But for some reason, whenever I run the task I got this error: FAILED! => {"msg": "The task includes …

Read More