# Iptables module fragment option

**URL:** <https://forum.ansible.com/t/iptables-module-fragment-option/30006>\
**Category:** Ansible Project\
**Created:** [March 27, 2019, 11:56pm UTC](https://forum.ansible.com/t/iptables-module-fragment-option/30006 "2019-03-27T23:56:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Guy\_Knights1](https://avatars.discourse-cdn.com/v4/letter/g/82dd89/32.png) [@Guy\_Knights1](https://forum.ansible.com/u/Guy_Knights1)\
**Post date:** [March 27, 2019, 11:56pm UTC](https://forum.ansible.com/t/iptables-module-fragment-option/30006/1 "2019-03-27T23:56:11Z")

</div>

I’m trying to add an iptables rule that uses the fragment option, and I cannot work out how to get it working using Ansible’s iptables module.

Here’s my task:

- name: drop fragmented packets  
iptables:  
jump: DROP  
chain: INPUT  
fragment: True  
action: append  
state: present

When I run this it fails with the following error:

FAILED! =\> {“changed”: false, “cmd”: “/sbin/iptables -t filter -A INPUT -j DROP -f True”, “msg”: “Bad argument `True'\nTry `iptables -h’ or ‘iptables --help’ for more information.”, “rc”: 2, “stderr”: “Bad argument `True'\nTry `iptables -h’ or ‘iptables --help’ for more information.\n”, “stderr\_lines”: [“Bad argument `True'", "Try `iptables -h’ or ‘iptables --help’ for more information.”], “stdout”: “”, “stdout\_lines”: }

So it’s trying to add the ‘True’ as an parameter to the ‘-f’ flag in the iptables command.

I tried again, this time removing the ‘True’ from the fragment option:

- name: drop fragmented packets  
iptables:  
jump: DROP  
chain: INPUT  
fragment:  
action: append  
state: present

This time it just adds the rule _without_ the ‘-f’ option to iptables, so the rule just drops everything - obviously not the behaviour I want.

So I looked at the module’s code and saw that it expects a string, so next I tried the following:

- name: drop fragmented packets  
iptables:  
jump: DROP  
chain: INPUT  
fragment: ‘’  
action: append  
state: present

This time, it fails with the following error:

FAILED! =\> {“changed”: false, “module\_stderr”: “Traceback (most recent call last):\n File "master:/root/mitogen/ansible\_mitogen/runner.py", line 883, in \_run\n self.\_run\_code(code, mod)\n File "master:/root/mitogen/ansible\_mitogen/runner.py", line 862, in \_run\_code\n exec(‘exec code in vars(mod)’)\n File "", line 1, in \n File "master:/usr/local/ansible/lib/ansible/modules/system/iptables.py", line 634, in \n File "master:/usr/local/ansible/lib/ansible/modules/system/iptables.py", line 581, in main\n File "master:/usr/local/ansible/lib/ansible/modules/system/iptables.py", line 434, in construct\_rule\n File "master:/usr/local/ansible/lib/ansible/modules/system/iptables.py", line 386, in append\_param\nIndexError: string index out of range\n”, “module\_stdout”: “”, “msg”: “MODULE FAILURE”, “rc”: 1}

The problem in this case is that the code is using the first character of the parameter to check for the negation/! option for the -f flag in iptables, so it fails due to the empty string.

How do I use the fragment option correctly?

Thanks,  
Guy