Ansible has a
ufw module in order to handle firewall rules. In
roles/common/tasks/main.yml, which is included in all my servers, I have (among other things):
- name: Install ufw
- name: Allow ssh through firewall
ufw: proto=tcp port=22 rule=allow
- name: Set ufw policy
ufw: state=enabled direction=incoming policy=deny
Edit: It is necessary to allow ssh before setting default policy to "deny" (originally it was opposite above), otherwise you may be locked out in between the two steps.
Then, in each role, I have additional firewall rules for that role. For example, in
roles/nginx/tasks/main.yml, I have (among other things) this:
- name: Allow nginx firewall
ufw: proto=tcp port=80 rule=allow
- name: Allow nginx ssl firewall
ufw: proto=tcp port=443 rule=allow
So all my nginx servers have ports 80 and 443 opened.
This way you can build whatever common configuration you want and add additional rules in more specific roles.
If you have rules which
ufw cannot handle, one solution I think would work nicely is
ferm; it can do almost anything, and you can configure it to read rules from directories such as
/etc/ferm/forward.d/, etc. You could make your
common role prepare the essential
ferm configuration and then have other roles drop files in these directories.
Your requirement to have
ansible specify rules in addition to rules specified in another way is unusual and apparently defies most of the point for using
ansible. Unfortunately I don't see any way to do it other than with plain
iptables, which would be quite ugly. Here is an example of opening up port 80 in
- name: Check if port 80 is allowed
shell: iptables -L | grep -q "Allow http" && echo -n yes || echo -n no
- name: Allow port 80
iptables -A INPUT -p tcp -m tcp --dport 80
-m comment --comment "Allow http" -j ACCEPT
when: check_allow_http.stdout == "no"
- Save iptables
Save iptables is a handler that executes
iptables-save. All the above is quite tedious to write, but it might be appropriate, especially if you have only a few rules to manage with