0

While try to describe my server in Ansible I really like the idea to form firewall rules so to enable only ports/protos that are used on host/host groups.

Imagine I have a linux based firewall box and webserver, mysql server and openvpn box behind it. As I set up webserver I apply some roles on it (http/https, ntp etc), and I'd like to add reqired ports/protos to firewall box iptables definition. And if later I disable ntp then I'd like to disable ntp-related lines in iptables for this box.

The idea is to have firewall setup connected to enabled services on boxes behind the firewall.

So the question is: is it possible to do that nice and elegant?

2 Answers 2

1

I almost always build my own roles for deploying services, and I generally put the firewall rules for those services directly in the role.

Here is an example, for nginx:

In roles/nginx/tasks/firewall.yml:

- name: Open ports with system-config-securitylevel
  command: "lokkit -q -p {{item}}:tcp"
  with_items: "{{nginx_firewall_open_services}}"
  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version|int == 5
  tags: firewall

- name: Open ports with system-config-firewall
  command: "lokkit -s {{item}}"
  with_items: "{{nginx_firewall_open_services}}"
  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version|int == 6
  tags: firewall

- name: Open ports with firewalld
  firewalld: "service={{item}} permanent=true immediate=true state=enabled"
  with_items: "{{nginx_firewall_open_services}}"
  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version|int >= 7
  tags: firewall

In roles/nginx/defaults/main.yml:

nginx_firewall_open_ports: [80, 443]
nginx_firewall_open_services: ["http", "https"]
3
  • This is for locally deployed firewalld, isn't it? What about centralized firewall that's cover the whole network of servers? The idea was to keep records of where which service is located then deploy summarize config on firewall device.
    – Alexander
    Apr 10, 2018 at 6:54
  • @Alexander Yes, this configures the host firewall. You can certainly write something to configure an external firewall, but that will be a completely different answer. Of course, you should have active host firewalls anyway, but that's also another discussion. Apr 10, 2018 at 15:38
  • I do understand this is different, but this is what I asked about. So to say, setting up on-host firewall is nice task but I'd really like to have cover-all firewall configured (say, if this is h/w firewall which is intended to do that).
    – Alexander
    Apr 11, 2018 at 6:51
0

You can use the when statement. Define a variable that denotes if the service should be enabled or not, check later for this variable in the task.

Example:

vars:
  enable_ntpd: yes
tasks:
- name: enable ntpd service
  service:
    name: ntpd
    enabled: yes
    state: started
  when: enable_ntpd
- name: disable ntpd service
  service:
    name: ntpd
    enabled: no
    state: stopped
  when: not enable_ntpd
- name: enable firewall for ntpd
  iptables:
    chain: INPUT
    protocol: udp
    destination_port: 123
    jump: ACCEPT
  when: enable_ntpd
- name: disable firewall for ntpd
  iptables:
    chain: INPUT
    protocol: udp
    destination_port: 123
    jump: DROP
  when: not enable_ntpd

Note: I'm not that familiar with ansibles iptables module, this might not be the best way, but you should get the idea

2
  • That is, I will list all possible services with when statements, testing each of it enabled? What I try to archive ports to be added from webserver etc boxes configs, not from firewall config.
    – Alexander
    Apr 9, 2018 at 13:42
  • Well, that's how ansible is intended to be used. You define your environment, ansible configures it for you. This suggestion allows you to define multiple configuration parts that belong together and can be configured with a single switch. If you want to change your firewall configuration dependent on if a service is enabled or not, ansible is probably not the right tool for the job. Apr 11, 2018 at 14:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .