For example, the idea is to restart a service but only once, not every time a change is made. You can have multiple tasks which may trigger one “notify” action and the related handler will be executed once. Handlers are most often placed and executed in the end of the playbook. Notify: saveiptables – These actions are used by Handlers (pretty similar to tasks, but will be executed only if the “notify” action is triggered). State: (absent/present) – This indicate whether the rule must exists or no. The Ansible specifics come in state: present and notify: saveiptables : It is pretty straight forward, as the parameters match the iptables commands and options.

name: Allow related and established connections IPV6 Here is an example with IPv6, pay attention that you have to specify – ip_version: ipv6 : name: Allow related and established connections IPV4 So here is an example, which will create firewall rules with Ansible playbook, such as the one above: It has most of the functionalities, you may use on daily basis, such as: chain, source/destination IP address, source/destination ports, logging, jump and many more.

Important notice is that it doesn’t save them permanently, but only update the one in the memory, so we will handle the saving in another way. There is a module for Ansible, which you can use to set up and maintain, iptables rules. The tricky question here is, what if we have to manage the firewall on 100 or 1000 servers and to keep track and consistency. The above command will put the rule above the number you have specified, which makes it the new rule number iptables -L -line-numbersģ ACCEPT tcp - 10.0.10.0/24 anywhere tcp dpt:domainĤ ACCEPT tcp - anywhere anywhere tcp dpt:https

You can add new iptables rules either above or below a certain rule, for example: iptables -I INPUT 3 -s 10.0.10.0/24 -p tcp -m tcp -dport 53 -j ACCEPT It shows the rules with their consecutive number. I really enjoy using: iptables -L -line-numbers Here is a simple iptables firewall on chain iptables -L -line-numbersġ ACCEPT all - anywhere anywhere ctstate RELATED,ESTABLISHEDĢ ACCEPT tcp - 10.0.10.0/24 anywhere tcp dpt:sshģ ACCEPT tcp - anywhere anywhere tcp dpt:https The typical manual way used for decades and the one with Ansible playbooks. Below you will find two ways to manage the iptables rules. Iptables, created more than 20 years ago 😀, is still the most frequent and common tool to manage the traffic to/from/through your Linux machine.

Ansible iptables