# iptables, new chains, marking

**URL:** <https://forum.ansible.com/t/iptables-new-chains-marking/31328>\
**Category:** Ansible Project\
**Created:** [September 21, 2019, 12:53am UTC](https://forum.ansible.com/t/iptables-new-chains-marking/31328 "2019-09-21T00:53:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marc\_Singer](https://avatars.discourse-cdn.com/v4/letter/m/7993a0/32.png) [@Marc\_Singer](https://forum.ansible.com/u/Marc_Singer)\
**Post date:** [September 21, 2019, 12:53am UTC](https://forum.ansible.com/t/iptables-new-chains-marking/31328/1 "2019-09-21T00:53:18Z")

</div>

Greetings,

I’m working to reimplement an existing firewall using the iptables module. I’m not seeing a command to create (or make to exist) a chain. Seems like this would be a relatively normal thing to do. Of course, I can create it elsewise since it only needs to be done once. Still, is there harm in it?

I also don’t see commands to handle marking. The match option is present, but I also need the ctorigdst/ctorigsrc and other options.

So, is the best way to work around this to simply issue the commands with “command”?

Cheers

---

<div class="post-metadata">

**Author:** ![vbotka](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/vbotka/32/359_2.png) [@vbotka](https://forum.ansible.com/u/vbotka)\
**Post date:** [September 21, 2019, 3:42am UTC](https://forum.ansible.com/t/iptables-new-chains-marking/31328/2 "2019-09-21T03:42:24Z")

</div>

Yes. In fact, that's what iptable module recommends:

"This module just deals with individual rules.If you need advanced chaining  
of rules the recommended way is to template the iptables restore file."  
[https://docs.ansible.com/ansible/latest/modules/iptables\_module.html#notes](https://docs.ansible.com/ansible/latest/modules/iptables_module.html#notes)

For example 1) create a template and 2) restore the iptables with a handler

&nbsp;&nbsp;- template:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;src: "iptables.j2"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;dest: "/etc/network/iptables"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;owner: "root"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;group: "root"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;mode: "0644"  
&nbsp;&nbsp;&nbsp;&nbsp;notify: reload iptables

&nbsp;&nbsp;- name: reload iptables  
&nbsp;&nbsp;&nbsp;&nbsp;shell: "/sbin/iptables-restore \< /etc/network/iptables"

The next option would be ufw  
[https://docs.ansible.com/ansible/latest/modules/ufw\_module.html](https://docs.ansible.com/ansible/latest/modules/ufw_module.html)

Cheers,

&nbsp;&nbsp;-vlado