diff options
Diffstat (limited to 'roles/os_firewall/tasks/firewall')
-rw-r--r-- | roles/os_firewall/tasks/firewall/firewalld.yml | 24 | ||||
-rw-r--r-- | roles/os_firewall/tasks/firewall/iptables.yml | 24 |
2 files changed, 36 insertions, 12 deletions
diff --git a/roles/os_firewall/tasks/firewall/firewalld.yml b/roles/os_firewall/tasks/firewall/firewalld.yml index ac4600f83..5ddca1fc0 100644 --- a/roles/os_firewall/tasks/firewall/firewalld.yml +++ b/roles/os_firewall/tasks/firewall/firewalld.yml @@ -24,6 +24,18 @@ command: systemctl daemon-reload when: install_result | changed +- name: Determine if firewalld service masked + command: > + systemctl is-enabled firewalld + register: os_firewall_firewalld_masked_output + changed_when: false + failed_when: false + +- name: Unmask firewalld service + command: > + systemctl unmask firewalld + when: os_firewall_firewalld_masked_output.stdout == "masked" + - name: Start and enable firewalld service service: name: firewalld @@ -52,29 +64,25 @@ port: "{{ item.port }}" permanent: false state: enabled - with_items: os_firewall_allow - when: os_firewall_allow is defined + with_items: "{{ os_firewall_allow }}" - name: Persist firewalld allow rules firewalld: port: "{{ item.port }}" permanent: true state: enabled - with_items: os_firewall_allow - when: os_firewall_allow is defined + with_items: "{{ os_firewall_allow }}" - name: Remove firewalld allow rules firewalld: port: "{{ item.port }}" permanent: false state: disabled - with_items: os_firewall_deny - when: os_firewall_deny is defined + with_items: "{{ os_firewall_deny }}" - name: Persist removal of firewalld allow rules firewalld: port: "{{ item.port }}" permanent: true state: disabled - with_items: os_firewall_deny - when: os_firewall_deny is defined + with_items: "{{ os_firewall_deny }}" diff --git a/roles/os_firewall/tasks/firewall/iptables.yml b/roles/os_firewall/tasks/firewall/iptables.yml index 3b584f8eb..774916798 100644 --- a/roles/os_firewall/tasks/firewall/iptables.yml +++ b/roles/os_firewall/tasks/firewall/iptables.yml @@ -32,6 +32,24 @@ command: systemctl daemon-reload when: install_result | changed +- name: Determine if iptables service masked + command: > + systemctl is-enabled {{ item }} + with_items: + - iptables + - ip6tables + register: os_firewall_iptables_masked_output + changed_when: false + failed_when: false + +- name: Unmask iptables service + command: > + systemctl unmask {{ item }} + with_items: + - iptables + - ip6tables + when: "'masked' in os_firewall_iptables_masked_output.results | map(attribute='stdout')" + - name: Start and enable iptables service service: name: iptables @@ -49,8 +67,7 @@ action: add protocol: "{{ item.port.split('/')[1] }}" port: "{{ item.port.split('/')[0] }}" - with_items: os_firewall_allow - when: os_firewall_allow is defined + with_items: "{{ os_firewall_allow }}" - name: Remove iptables rules os_firewall_manage_iptables: @@ -58,5 +75,4 @@ action: remove protocol: "{{ item.port.split('/')[1] }}" port: "{{ item.port.split('/')[0] }}" - with_items: os_firewall_deny - when: os_firewall_deny is defined + with_items: "{{ os_firewall_deny }}" |