# But in iptables module?

**URL:** <https://forum.ansible.com/t/but-in-iptables-module/20926>\
**Category:** Ansible Project\
**Tags:** ubuntu\
**Created:** [March 18, 2016, 9:07pm UTC](https://forum.ansible.com/t/but-in-iptables-module/20926 "2016-03-18T21:07:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joshua\_J\_Kugler](https://avatars.discourse-cdn.com/v4/letter/j/ecc23a/32.png) [@Joshua\_J\_Kugler](https://forum.ansible.com/u/Joshua_J_Kugler)\
**Post date:** [March 18, 2016, 9:07pm UTC](https://forum.ansible.com/t/but-in-iptables-module/20926/1 "2016-03-18T21:07:25Z")

</div>

I'm trying to use the iptables module, and I \*think\* I'm hitting a bug. Wanted  
a sanity check before I open a bug report. This is Ansible 2.0.0.2. The action  
looks like this:

&nbsp;&nbsp;&nbsp;- name: Update IPtables rules  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;iptables:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;chain: INPUT  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;match: state  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ctstate: NEW,RELATED,ESTABLISHED  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;destination\_port: 6556  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;protocol: tcp  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;jump: ACCEPT

It's failing with this:

&nbsp;&nbsp;fatal: [ubuntu:]: FAILED! =\> {  
&nbsp;&nbsp;"changed": false,  
&nbsp;&nbsp;"cmd": "\/sbin\/iptables -t filter -A INPUT -p tcp -m state -j ACCEPT --  
destination-port 6556 -m state --state NEW,RELATED,ESTABLISHED",  
&nbsp;&nbsp;"failed": true,  
&nbsp;&nbsp;"msg": "iptables v1.4.21: state: option \"--state\" must be specified\n\nTry  
`iptables -h' or 'iptables --help' for more information.",  
&nbsp;&nbsp;"rc": 2,  
&nbsp;&nbsp;"stderr": "iptables v1.4.21: state: option \"--state\" must be  
specified\n\nTry `iptables -h' or 'iptables --help' for more information.\n",  
&nbsp;&nbsp;"stdout": "",  
&nbsp;&nbsp;"stdout\_lines": [  
&nbsp;&nbsp;&nbsp;&nbsp;  
&nbsp;&nbsp;]  
}

The command it's trying to run is this:

-t filter -A INPUT -p tcp -m state -j ACCEPT --destination-port 6556 -m state  
--state NEW,RELATED,ESTABLISHED

Notice how it puts an '-m state' before the '-j ACCEPT' and then it does the  
'-m state --state ..." properly later.

Bug? Or something I'm missing?

j

---

<div class="post-metadata">

**Author:** ![Dejay\_Clayton](https://avatars.discourse-cdn.com/v4/letter/d/6de8d8/32.png) [@Dejay\_Clayton](https://forum.ansible.com/u/Dejay_Clayton)\
**Post date:** [March 20, 2016, 5:41am UTC](https://forum.ansible.com/t/but-in-iptables-module/20926/2 "2016-03-20T05:41:39Z")

</div>

Looks like a bug to me.

---

<div class="post-metadata">

**Author:** ![Martin\_Terp\_Jensen1](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Martin\_Terp\_Jensen1](https://forum.ansible.com/u/Martin_Terp_Jensen1)\
**Post date:** [March 20, 2016, 7:27pm UTC](https://forum.ansible.com/t/but-in-iptables-module/20926/3 "2016-03-20T19:27:14Z")

</div>

I belive you need to use “match: conntrack” instead of “match: state” when using ctstate

---

<div class="post-metadata">

**Author:** ![Martin\_Terp\_Jensen](https://avatars.discourse-cdn.com/v4/letter/m/b487fb/32.png) [@Martin\_Terp\_Jensen](https://forum.ansible.com/u/Martin_Terp_Jensen)\
**Post date:** [March 20, 2016, 7:30pm UTC](https://forum.ansible.com/t/but-in-iptables-module/20926/4 "2016-03-20T19:30:46Z")

</div>

I belive you need to use “match: conntrack” instead of “match: state” when using ctstate