# firewall playbook using when module

**URL:** <https://forum.ansible.com/t/firewall-playbook-using-when-module/30797>\
**Category:** Ansible Project\
**Created:** [July 17, 2019, 3:49am UTC](https://forum.ansible.com/t/firewall-playbook-using-when-module/30797 "2019-07-17T03:49:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Annam\_Rafi1](https://avatars.discourse-cdn.com/v4/letter/a/e79b87/32.png) [@Annam\_Rafi1](https://forum.ansible.com/u/Annam_Rafi1)\
**Post date:** [July 17, 2019, 3:49am UTC](https://forum.ansible.com/t/firewall-playbook-using-when-module/30797/1 "2019-07-17T03:49:53Z")

</div>

I am trying to create a playbook to check if the firewall is running, if so add the rsyslog port. If the firewall is not running, id like to skip the port adding step. Please share some docs. I can’t seem to find any. So far I’ve came up with this…

# - name: ensure that firewalld is running

# service:

# name: “syslog”

# state: started

# enabled: yes

# register: firewalld\_status

# - debug: msg=“firewalld is running”

# when: firewalld\_status.stdout.find(“running”) != -1

---

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [July 17, 2019, 5:51am UTC](https://forum.ansible.com/t/firewall-playbook-using-when-module/30797/2 "2019-07-17T05:51:00Z")

</div>

You say you want to add a port to the firewall if it’s running. But your playbook logic currently first makes sure that the firewall is running (state=started). So the subsequent conditional tasks for when firewalld is NOT running will never be executed.

You have to make a clear decision what you want to do. Either go for ensuring firewalld is running and add that port.  
Or only check if it’s running and if it is, add the port.

You can use  
[https://docs.ansible.com/ansible/latest/modules/service\_facts\_module.html](https://docs.ansible.com/ansible/latest/modules/service_facts_module.html) for this.

BTW I don’t understand what the rsyslog service is needed for… the task name (“Try to restart 1514 if not started” ??) doesn’t match what that task does (ensuring rsyslog is started and enabled).  
It also uses a variable called port\_check which is unknown, which leads me to believe there are other prior tasks involved?

Dick