# How to modify (add) iptables rules in awx-on-k3s **URL:** \ **Category:** AWX Project\ **Tags:** awx\ **Created:** [November 23, 2022, 5:47pm UTC](https://forum.ansible.com/t/how-to-modify-add-iptables-rules-in-awx-on-k3s/37383 "2022-11-23T17:47:44Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![HG1](https://avatars.discourse-cdn.com/v4/letter/h/b782af/32.png) [@HG1](https://forum.ansible.com/u/HG1)\ **Post date:** [November 23, 2022, 5:47pm UTC](https://forum.ansible.com/t/how-to-modify-add-iptables-rules-in-awx-on-k3s/37383/1 "2022-11-23T17:47:44Z")
Hi, I have installed awx-on-k3s as described by kurokobo on [https://github.com/kurokobo/awx-on-k3s](https://github.com/kurokobo/awx-on-k3s). My postgres database is external and no longer inside a pod/container. Now I want to add firewall rules to harden the system. How can I add iptables rules at the host level to close ports that are open from outside while they do not have to be accessible from outside? Any help ? Regards Hans ---
**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\ **Post date:** [November 23, 2022, 7:41pm UTC](https://forum.ansible.com/t/how-to-modify-add-iptables-rules-in-awx-on-k3s/37383/2 "2022-11-23T19:41:43Z")
If you are talking about setting up a firewall on your external database, this is probably not the best place to ask. You should only need open up the postgres port you specified (default is 5432). If that is not the case, could you clarify your question? Thanks, AWX Team ---
**Author:** ![HG1](https://avatars.discourse-cdn.com/v4/letter/h/b782af/32.png) [@HG1](https://forum.ansible.com/u/HG1)\ **Post date:** [November 23, 2022, 8:13pm UTC](https://forum.ansible.com/t/how-to-modify-add-iptables-rules-in-awx-on-k3s/37383/3 "2022-11-23T20:13:00Z")
No I want to add rules to close ports (5432 postgres, 53 Dnsmasq and others) from outside. Imho, since my setup is a single node all ports used for awx and k3s can be closed e.g. 10250 etc. Only 22 for ash and 443 are necessary. Correct? ---
**Author:** ![HG1](https://avatars.discourse-cdn.com/v4/letter/h/b782af/32.png) [@HG1](https://forum.ansible.com/u/HG1)\ **Post date:** [December 1, 2022, 9:16am UTC](https://forum.ansible.com/t/how-to-modify-add-iptables-rules-in-awx-on-k3s/37383/4 "2022-12-01T09:16:05Z")
Hi I have clarified the question. Do you have any updates? Regards Hans ---
**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\ **Post date:** [December 9, 2022, 6:44pm UTC](https://forum.ansible.com/t/how-to-modify-add-iptables-rules-in-awx-on-k3s/37383/5 "2022-12-09T18:44:13Z")
Did you ever resolve this? This dose not feel like an AWX question directly as you should be able to close whatever ports you want to on the host but if you close too much you may loose functionality. Our best suggestion would be to try it and see what happens. -The AWX Team ---
**Author:** ![HG1](https://avatars.discourse-cdn.com/v4/letter/h/b782af/32.png) [@HG1](https://forum.ansible.com/u/HG1)\ **Post date:** [December 12, 2022, 2:31pm UTC](https://forum.ansible.com/t/how-to-modify-add-iptables-rules-in-awx-on-k3s/37383/6 "2022-12-12T14:31:05Z")
HI, No I have not yet been able to do this. But I am researching Regards Hans-Peter ---
**Author:** ![HG1](https://avatars.discourse-cdn.com/v4/letter/h/b782af/32.png) [@HG1](https://forum.ansible.com/u/HG1)\ **Post date:** [March 2, 2023, 8:59am UTC](https://forum.ansible.com/t/how-to-modify-add-iptables-rules-in-awx-on-k3s/37383/7 "2023-03-02T08:59:11Z")
Hi I finally got it working on Redhat!! 1. Remove iptables/firewalld (if installed) 2. Install nftables Since nftables is based on eBPF you will not see a process running. You will see the service as active when you do systemctl status nftables. K3S will add the rules to nftables. 3. Create a script to add a new table that meet your requirements I have attached my script. Apart from ssh, 443 and 9090 it allows connections to 5432 for postgres (in my case it is unmanaged) > **(attachments)** > > [inet.nft](https://forum.ansible.com/uploads/short-url/jWReySmv23tttSvovZepfuCaYkX.nft) (1.33 KB)